Problem/Motivation

Codex identified some concerns about logging:

- High: debug HTTP logging can leak OAuth bearer tokens, registration tokens,
and message bodies. web/modules/orig/firebase_php/src/Service/
FirebasePhpMessagingService.php:87 uses MessageFormatter::DEBUG; Guzzle’s
formatter expands that to the full request and response, including headers
and bodies. Replace this with a redacted formatter, and avoid logging
request/response bodies by default.

- Medium: token and payload logging can expose push-registration tokens and
message data. web/modules/orig/firebase_php/src/Service/
FirebasePhpMessagingApi.php:271 logs full failed messages in debug mode,
and web/modules/orig/firebase_php/src/Service/
FirebasePhpMessagingApi.php:316 logs validation output when enabled. Redact
or hash tokens and avoid logging arbitrary message data.

Issue fork firebase_php-3593804

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

ptmkenny created an issue. See original summary.

ptmkenny opened merge request !61

ptmkenny’s picture

ptmkenny commented
Title: Security hardening: Do not log sensitive values even optionally » Security hardening: Do not log sensitive values

  • ptmkenny committed 8b6a21fe on 8.0.x 
    fix: #3593804 Security hardening: Do not log sensitive values (...
ptmkenny’s picture

ptmkenny commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.