Problem/Motivation

Identified by Fable:

  1. Raw token leaked into logs by the FCM presave hook (contradicts the module's own redaction policy).
  FirebasePhpIntegrationHooks::pnRegistrationTokenPresave()
  (submodules/firebase_php_integration/src/Hook/FirebasePhpIntegrationHooks.php:36) throws with the raw token embedded:
  "...Failed token: {$token_to_validate}". When this fires during user.add_push_token, the \Throwable catch in
  AddPushToken.php:100 logs the full exception to watchdog, so the raw registration token lands in the database log.
  firebase_php goes to great lengths to hash tokens everywhere else (hashTokenForLog()); this one path defeats that. It
  can also surface on-screen if the exception bubbles up through the admin entity form. Recommend hashing the token in the
  exception message.
Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

ptmkenny created an issue. See original summary.

  • ptmkenny committed 19ff5cd7 on 1.0.x
    fix: #3607824 Raw token leaked into logs by presave hook
    
    By: ptmkenny
    
ptmkenny’s picture

Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.