ilyabrin / disk / 37535403916

78%

release: 78%

Pull #84

github

fix: make request logging show what it says it shows

LogRequest had its branches the wrong way round. Ordinary headers such as
Content-Type were printed as "[sanitized]", while the Authorization header
was printed masked. As a side effect SanitizeAuth: false, which should log
values unchanged, hid every header instead.

The masking itself kept the first four and last two characters. For
Authorization the first four were a truncated "OAut"; for a header such as
X-Api-Key they were the start of the secret.

Ordinary headers are now logged as they are. A credential-bearing header
becomes "***", and Authorization keeps its scheme, as in "OAuth ***", so
the log still says what kind of credential was sent without showing any
of it. SanitizeAuth: false now logs values unchanged, as its name says.
Headers are sorted by name, so two runs can be compared line by line.

The masking marker stays "***", which keeps SanitizeValue's existing
contract and leaves the older logger tests passing unchanged. The new
tests fail against the previous code.

16 of 16 new or added lines in 1 file covered. (100.0%)

1919 of 2454 relevant lines covered (78.2%)

19.42 hits per line