clawbot
c7c4ea3340
check / check (push) Waiting to run
A Sentry event kept the Referer header verbatim, and a Referer can be an entrypoint URL: a sender that follows the README's http:// to https:// redirect sends the URL it was redirected from, and a browser sends the 404 page's URL under /h/ when it fetches that page's stylesheet. The Sentry hook now keeps only the Referer's scheme and host. The access log's reduction moves, unchanged, into a new package, internal/referer, as SchemeAndHost; the access log and the Sentry hook both call it there. The comment above sentryKeepsHeader and the README's Sentry passage say so, and the README's Package Layout lists the new package. Model: opus-5-5
33 lines
1.1 KiB
Go
33 lines
1.1 KiB
Go
// Package referer reduces a Referer header to its scheme and host, so
|
|
// that a URL path, which on the receiver route carries the entrypoint
|
|
// UUID, never reaches a log line or an error report.
|
|
package referer
|
|
|
|
import "net/url"
|
|
|
|
// redacted stands in for a Referer that cannot be reduced to its
|
|
// scheme and host.
|
|
const redacted = "(redacted)"
|
|
|
|
// SchemeAndHost returns a Referer's scheme and host, never its path or
|
|
// query. The path can be an entrypoint URL, which carries the UUID: a
|
|
// sender that follows a redirect from http:// to https:// sends the
|
|
// URL it was redirected from, and a browser sends the 404 page's URL
|
|
// under /h/ when it fetches that page's stylesheet. A Referer without
|
|
// both a scheme and a host comes back as "(redacted)".
|
|
//
|
|
// It is the access log's referer field, and the Referer header the
|
|
// Sentry hook sends.
|
|
func SchemeAndHost(referer string) string {
|
|
if referer == "" {
|
|
return ""
|
|
}
|
|
|
|
parsed, err := url.Parse(referer)
|
|
if err != nil || parsed.Scheme == "" || parsed.Host == "" {
|
|
return redacted
|
|
}
|
|
|
|
return parsed.Scheme + "://" + parsed.Host
|
|
}
|