Redact password in logs
Open
Beginner friendly
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 1.6k
- Forks
- 406
- PR merge metrics
- No merged PRs in 30d
Description
Software often logs urls using std::format::Display. Example from ureq HTTP client library:
info!("sending request {} {}", method, url);
When the Url contains a password, the password ends up in the logs:
INFO sending request GET https://ACa6e1ce:5eadb27757bd50f8f01d4bcac866e@lookups.twilio.com/v1/PhoneNumbers/10001112222
This is a security risk. Let's change Url's impl Display to redact the password:
INFO sending request GET https://ACa6e1ce:***@lookups.twilio.com/v1/PhoneNumbers/10001112222
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at Url's std::format::Display implementation, which controls how URLs appear in log messages. Reproduce formatting with a URL containing userinfo and verify that the password is replaced with *** while the rest of the URL remains unchanged; add or update coverage for this behavior if the existing tests are nearby.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100