BC-5044 - prevent password logging of failed edusharing requests

hpi-schul-cloud · Oct 10, 2023 · 4d5a69c · 4d5a69c
1 parent 2b27ebe
commit 4d5a69c
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/src/middleware/errorHandler.js b/src/middleware/errorHandler.js
@@ -125,6 +125,7 @@ const secretDataKeys = (() =>
 		'gradeComment',
 		'_csrf',
 		'searchUserPassword',
+		'authorization',
 	].map((k) => k.toLocaleLowerCase()))();
 
 const filterSecretValue = (key, value) => {
@@ -174,6 +175,7 @@ const filterSecrets = (error, req, res, next) => {
 	if (error) {
 		// req.url = filterQuery(req.url);
 		req.originalUrl = filterQuery(req.originalUrl);
+		req.headers = filter(req.headers);
 		req.body = filter(req.body);
 		error.data = filter(error.data);
 		error.options = filter(error.options);

diff --git a/src/services/edusharing/services/EduSharingConnectorV6.js b/src/services/edusharing/services/EduSharingConnectorV6.js
@@ -114,7 +114,9 @@ class EduSharingConnector {
 			if (err.statusCode === 404) {
 				return null;
 			}
-			logger.error(`Edu-Sharing failed request with error ${err.statusCode} ${err.message}`, options);
+			// eslint-disable-next-line no-unused-vars
+			const { headers, ...logOptions } = options;
+			logger.error(`Edu-Sharing failed request with error ${err.statusCode} ${err.message}`, logOptions);
 			if (retried === true) {
 				throw new GeneralError('Edu-Sharing Request failed');
 			} else {