@marcel91200 / caddy Mirror · read-only / commits / f137b822
Fork 0

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

Mirrored from https://github.com/Slazee/caddy.git

Synced Nov 14, 05:15 UTC

logging: add replace filter for static value replacement (#4029)

This filter is intended to be useful in scenarios where you may want to redact a value with a static string, giving you information that the field did previously exist and was present, but not revealing the value itself in the logs. This was inspired by work on adding more complete support for removing sensitive values from logs [1]. An example use case would be the Authorization header in request log output, for which the value should usually not be logged, but it may be quite useful for debugging to confirm that the header was present in the request. [1] https://github.com/caddyserver/caddy/issues/3958

Aaron Taylor committed Mar 12, 2021 at 15:01 UTC f137b82227f7b32b2ca036a89068c806a29a5ac7
2 files changed +36 -3
caddytest/integration/caddyfile_adapt/log_filters.txt
+4 -3
@@ -5,7 +5,7 @@ log {
5 format filter {
6 wrap console
7 fields {
8 - request>headers>Authorization delete
8 + request>headers>Authorization replace REDACTED
9 request>headers>Server delete
10 request>remote_addr ip_mask {
11 ipv4 24
@@ -30,7 +30,8 @@ log {
30 "encoder": {
31 "fields": {
32 "request\u003eheaders\u003eAuthorization": {
33 - "filter": "delete"
33 + "filter": "replace",
34 + "value": "REDACTED"
35 },
36 "request\u003eheaders\u003eServer": {
37 "filter": "delete"
@@ -66,4 +67,4 @@ log {
67 }
68 }
69 }
69 -}
\ No newline at end of file
70 +}
modules/logging/filters.go
+32
@@ -25,6 +25,7 @@ import (
25
26 func init() {
27 caddy.RegisterModule(DeleteFilter{})
28 + caddy.RegisterModule(ReplaceFilter{})
29 caddy.RegisterModule(IPMaskFilter{})
30 }
31
@@ -57,6 +58,37 @@ func (DeleteFilter) Filter(in zapcore.Field) zapcore.Field {
58 return in
59 }
60
61 +// ReplaceFilter is a Caddy log field filter that
62 +// replaces the field with the indicated string.
63 +type ReplaceFilter struct {
64 + Value string `json:"value,omitempty"`
65 +}
66 +
67 +// CaddyModule returns the Caddy module information.
68 +func (ReplaceFilter) CaddyModule() caddy.ModuleInfo {
69 + return caddy.ModuleInfo{
70 + ID: "caddy.logging.encoders.filter.replace",
71 + New: func() caddy.Module { return new(ReplaceFilter) },
72 + }
73 +}
74 +
75 +// UnmarshalCaddyfile sets up the module from Caddyfile tokens.
76 +func (f *ReplaceFilter) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
77 + for d.Next() {
78 + if d.NextArg() {
79 + f.Value = d.Val()
80 + }
81 + }
82 + return nil
83 +}
84 +
85 +// Filter filters the input field with the replacement value.
86 +func (f *ReplaceFilter) Filter(in zapcore.Field) zapcore.Field {
87 + in.Type = zapcore.StringType
88 + in.String = f.Value
89 + return in
90 +}
91 +
92 // IPMaskFilter is a Caddy log field filter that
93 // masks IP addresses.
94 type IPMaskFilter struct {