masked sensitive data in logs - #507
akaila-splunk merged 4 commits into
Conversation
Sorry, something went wrong.
l00py
left a comment
There was a problem hiding this comment.
Added comments for review
Sorry, something went wrong.
| except Exception as ex: | ||
| return data | ||
|
|
||
| if not isinstance(data, dict): |
There was a problem hiding this comment.
Duplicate to lines 87-91?
Sorry, something went wrong.
| "HTTPError" | ||
| ] | ||
|
|
||
| SENSITIVE_KEYS = ["password", "token", "Authorization"] |
There was a problem hiding this comment.
May want to review the request params for the supported endpoints specified here: https://github.com/splunk/splunk-sdk-python/blob/develop/splunklib/client.py#L90-L113
For example:
- apps/local
- auth
- session
- configs/conf
- POST to conf files may contain sensitive information, but we can do a best-effort based on the current conf specs, and what files are normally interacted with. It may be best to provide a different logic for masking sensitive information for that specific endpoint.
Sorry, something went wrong.
| all_headers = headers + self.additional_headers + self._auth_headers | ||
| logger.debug("%s request to %s (headers: %s, body: %s)", | ||
| method, path, str(all_headers), repr(body)) | ||
| method, path, str(all_headers), mask_sensitive_data(body)) |
There was a problem hiding this comment.
The headers can contain sensitive data, specifically the original headers being passed via the handler in https://github.com/splunk/splunk-sdk-python/blob/develop/splunklib/binding.py#L1443-L1444
Sorry, something went wrong.
- updated keys in SENSITIVE_KEYS list - masked headers data in logger
l00py
left a comment
There was a problem hiding this comment.
LGTM
Sorry, something went wrong.
added new method to mask sensitive data in logs like password. changes wrt issue #506