sneak
5b18ddf4ca
With debug mode on, debugFetch logged every request's full URL and body, so an RPC endpoint with an API key in its path or query string printed that key to the console on every request. It now logs the HTTP method, the URL's origin and, for a JSON-RPC body, the method name. The balance refresh and token lookup log the RPC endpoint by its origin too. Failed RPC calls print ethers' short message, since its full message for an HTTP error carries the request URL. A failed endpoint check in settings prints the endpoint's origin, since fetch's error for a URL with a user name and password carries the whole URL. The README's DEBUG Mode Policy says what debug mode logs. Model: opus-5-5
54 lines
1.9 KiB
JavaScript
54 lines
1.9 KiB
JavaScript
// What debugFetch writes to the console in debug mode.
|
|
//
|
|
// RPC providers put the API key in the URL's path or query string, and the
|
|
// debug log used to print the whole URL and request body, so turning debug
|
|
// mode on wrote the key to the console
|
|
// (https://git.eeqj.de/sneak/AutistMask/issues/410). The log now names the
|
|
// HTTP method, the URL's origin and the JSON-RPC method, and nothing else of
|
|
// the request.
|
|
|
|
const { debugFetch, urlOrigin, setRuntimeDebug } = require("../src/shared/log");
|
|
|
|
const realFetch = globalThis.fetch;
|
|
|
|
afterEach(() => {
|
|
globalThis.fetch = realFetch;
|
|
setRuntimeDebug(false);
|
|
jest.restoreAllMocks();
|
|
});
|
|
|
|
test("logs the origin and JSON-RPC method, not the key in the URL", async () => {
|
|
setRuntimeDebug(true);
|
|
const consoleLog = jest.spyOn(console, "log").mockImplementation(() => {});
|
|
globalThis.fetch = jest.fn(async () => ({ status: 200 }));
|
|
|
|
await debugFetch(
|
|
"https://rpc.example.invalid/v3/PATHKEY123?token=QUERYTOKEN456",
|
|
{
|
|
method: "POST",
|
|
headers: { "Content-Type": "application/json" },
|
|
body: JSON.stringify({
|
|
jsonrpc: "2.0",
|
|
id: 1,
|
|
method: "eth_chainId",
|
|
params: [],
|
|
}),
|
|
},
|
|
);
|
|
|
|
const logged = consoleLog.mock.calls.flat().join(" ");
|
|
expect(logged).not.toContain("PATHKEY123");
|
|
expect(logged).not.toContain("QUERYTOKEN456");
|
|
expect(logged).toContain("https://rpc.example.invalid");
|
|
expect(logged).toContain("eth_chainId");
|
|
});
|
|
|
|
test("the origin leaves out a user name and password in the URL", () => {
|
|
expect(
|
|
urlOrigin("https://user:SECRETPASS@rpc.example.invalid/v3/KEY"),
|
|
).toBe("https://rpc.example.invalid");
|
|
expect(urlOrigin("wss://user:SECRETPASS@rpc.example.invalid:8546/")).toBe(
|
|
"wss://rpc.example.invalid:8546",
|
|
);
|
|
});
|