Part of #169. sneak, 4 November: secrets in query strings, such as Gitea's ?token=, never reach the log or the ban notes. Today the request log's query field carries the query whole (internal/proxy/request.go, the log line's Query), and so do a ban's notes (internal/proxy/bans.go, noted) and the Core Rule Set's alert (internal/proxy/coreruleset.go, its path).
What to build
Wherever smallwebwaf writes a request's query, in the request log, a ban's notes, an alert, or a Core Rule Set match it logs, the value of a query parameter whose name is one of these, compared without regard to case, is replaced by REDACTED: token, access_token, refresh_token, id_token, api_key, apikey, key, secret, client_secret, password, passwd, pwd, auth, sig, signature, code, x-amz-credential, x-amz-signature, x-amz-security-token. The name and every other parameter stay as sent.
One function does it, in the package that writes the request log line, and every place above calls it.
The query the app receives is untouched.
No setting.
Tests
Each place above, with Gitea's ?token= and ?access_token=, upper and lower case, a parameter given twice, and an ordinary query left as it is.
Documents
docs/request-log.md, docs/state-files.md (the ban notes) and docs/alerts.md say which values are replaced. SPEC.md's "Request log" says it in a line.
Model: opus-5-5
Part of https://git.eeqj.de/sneak/smallwebwaf/issues/169. sneak, 4 November: secrets in query strings, such as Gitea's `?token=`, never reach the log or the ban notes. Today the request log's `query` field carries the query whole (`internal/proxy/request.go`, the log line's `Query`), and so do a ban's notes (`internal/proxy/bans.go`, `noted`) and the Core Rule Set's alert (`internal/proxy/coreruleset.go`, its `path`).
## What to build
- Wherever smallwebwaf writes a request's query, in the request log, a ban's notes, an alert, or a Core Rule Set match it logs, the value of a query parameter whose name is one of these, compared without regard to case, is replaced by `REDACTED`: `token`, `access_token`, `refresh_token`, `id_token`, `api_key`, `apikey`, `key`, `secret`, `client_secret`, `password`, `passwd`, `pwd`, `auth`, `sig`, `signature`, `code`, `x-amz-credential`, `x-amz-signature`, `x-amz-security-token`. The name and every other parameter stay as sent.
- One function does it, in the package that writes the request log line, and every place above calls it.
- The query the app receives is untouched.
- No setting.
## Tests
Each place above, with Gitea's `?token=` and `?access_token=`, upper and lower case, a parameter given twice, and an ordinary query left as it is.
## Documents
`docs/request-log.md`, `docs/state-files.md` (the ban notes) and `docs/alerts.md` say which values are replaced. `SPEC.md`'s "Request log" says it in a line.
Model: opus-5-5
clawbot
self-assigned this 2026-11-04 20:09:56 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Part of #169. sneak, 4 November: secrets in query strings, such as Gitea's
?token=, never reach the log or the ban notes. Today the request log'squeryfield carries the query whole (internal/proxy/request.go, the log line'sQuery), and so do a ban's notes (internal/proxy/bans.go,noted) and the Core Rule Set's alert (internal/proxy/coreruleset.go, itspath).What to build
REDACTED:token,access_token,refresh_token,id_token,api_key,apikey,key,secret,client_secret,password,passwd,pwd,auth,sig,signature,code,x-amz-credential,x-amz-signature,x-amz-security-token. The name and every other parameter stay as sent.Tests
Each place above, with Gitea's
?token=and?access_token=, upper and lower case, a parameter given twice, and an ordinary query left as it is.Documents
docs/request-log.md,docs/state-files.md(the ban notes) anddocs/alerts.mdsay which values are replaced.SPEC.md's "Request log" says it in a line.Model: opus-5-5
no. query strings get logged verbatim. why wouldn't we want the exact queries logged? secrets go in POST data. query strings are assumed to be logged.