clawbot
76725cffc4
All checks were successful
check / check (push) Successful in 2m53s
r.FormValue falls back to the query string, so
POST /source/{id}/targets?url=<secret> created a working target from a
value carried on the request line — where proxy logs, browser history
and Referer all record it. Every form read is now r.PostFormValue,
including the login password and both password-change fields, which had
the same defect in a more acute form.
The Sentry leg needed more than the query string. sentryhttp attaches
the whole request to the scope, and ApplyToEvent copies the teed body
into Request.Data with no SendDefaultPII guard — so reading every field
from the body only pointed every credential this change protects at the
one field the first revision did not scrub. Body and query are now
redacted, Cookies and Env cleared, and Headers reduced to an allowlist,
because the SDK's own filter removes four names and would otherwise ship
X-Csrf-Token and the shared secrets senders put on the receiver route.
Also adds json:"-" to Target.Config, APIKey.Key and Setting.Value —
TargetView is the masking barrier for the HTML path only, and the first
handler to marshal a model would serialise a bearer token or the session
encryption key.
Independently reviewed three times. The second review found the Data
leak and proved it with a scratch module; the third disproved the
PR's own claim that BeforeSend gets no request, so the README now
records that redacting unconditionally is a deliberate choice rather
than a limitation — which is what makes #179 cheap to fix.
41 lines
1.3 KiB
Go
41 lines
1.3 KiB
Go
package database
|
|
|
|
// TargetType represents the type of delivery target
|
|
type TargetType string
|
|
|
|
// Target type values.
|
|
const (
|
|
TargetTypeHTTP TargetType = "http"
|
|
TargetTypeDatabase TargetType = "database"
|
|
TargetTypeLog TargetType = "log"
|
|
TargetTypeSlack TargetType = "slack"
|
|
)
|
|
|
|
// Target represents a delivery target for a webhook
|
|
type Target struct {
|
|
BaseModel
|
|
|
|
WebhookID string `gorm:"type:uuid;not null" json:"webhookId"`
|
|
Name string `gorm:"not null" json:"name"`
|
|
Type TargetType `gorm:"not null" json:"type"`
|
|
Active bool `gorm:"default:true" json:"active"`
|
|
|
|
// Configuration fields (JSON stored based on type).
|
|
//
|
|
// json:"-" because the blob holds the target's credential — a
|
|
// Slack incoming-webhook URL, or an http destination whose path
|
|
// segments are the secret. delivery.TargetView is the masking
|
|
// barrier for the HTML path; this tag is the barrier for any
|
|
// handler that marshals the model itself.
|
|
Config string `gorm:"type:text" json:"-"` // JSON configuration
|
|
|
|
// For HTTP targets (max_retries=0 means fire-and-forget,
|
|
// >0 enables retries with backoff)
|
|
MaxRetries int `json:"maxRetries,omitempty"`
|
|
MaxQueueSize int `json:"maxQueueSize,omitempty"`
|
|
|
|
// Relations
|
|
Webhook Webhook `json:"webhook,omitzero"`
|
|
Deliveries []Delivery `json:"deliveries,omitempty"`
|
|
}
|