Filter sensitive data from `Log::Emitter`

jgaskins · January 5, 2022, 7:31am

Is there an easy way to set up a wide-scale (global, even?) filter for sensitive properties for Log::Emitter? Maybe a shard? Or does that need to be handled in application code?

Wondering because I often want to shovel data wholesale into Log.context to be picked up by OpenTelemetry and Honeybadger or even just for old-fashioned logging. Things like HTTP params or headers, but I don’t want sensitive data (passwords, OAuth tokens, cookies, etc) stored by these services.

Manually allowing or filtering keys is getting tedious, so I’m trying to come up with a centralized config for it where either Log::Emitter will skip over it or Log.context wouldn’t store it at all. For example, an ENV var with the names of keys to either allow or filter out, which I could put into a single Kubernetes ConfigMap.

bcardiff · January 5, 2022, 1:58pm

I always thought of that being filtered by the backend directly. Having a FilteredBackend that would act as a decorator is a way to go, you would need to regenerate the Log::Entry on abstract def write(entry : Entry).

But this means that the sensitive data will be in memory.

If you want to avoid that, then the place for this change I think is in the Log::Metadata.setup method: crystal/metadata.cr at 5455e807b9314c82ab16dd8c557f04c3b04a34b5 · bcardiff/crystal · GitHub

There you could check against key names and change the value to a "**FILTERED**" value for example.

Yet metadata can be nested. If we want to filter not only the top level keys, then the change might require to change Log::Value.to_metadata_value to receive the key of the value and apply the filtering logic there. crystal/metadata.cr at 5455e807b9314c82ab16dd8c557f04c3b04a34b5 · bcardiff/crystal · GitHub . There are 4 calls to that (private) method.

stakach · January 6, 2022, 12:04pm

Yeah we built a log backend that adds filtering for spider-gazelle

github.com

spider-gazelle/action-controller/blob/master/src/action-controller/log_handler.cr#L116

    
      
              "#{elapsed.total_minutes.round 2}m"
            when .>= 1.seconds
              "#{elapsed.total_seconds.round 2}s"
            when .>= 1.milliseconds
              "#{elapsed.total_milliseconds.round 2}ms"
            else
              "#{elapsed.total_microseconds.round 2}µs"
            end
          end
          
          
private def filter_path(path)
            return path if @filter.empty?
            path.gsub(/(\?|\&)([^&;=]+)=([^&;=]+)/) do |value|
              filter = false
              @filter.each do |key|
                if $2 == key
                  filter = true
                  break
                end
              end
              filter ? "#{$1}#{$2}=[FILTERED]" : value

github.com

spider-gazelle/spider-gazelle/blob/5424d315a54f8ba44a4b98304e90f0a30787dd06/src/config.cr#L27

    
      
            log_level = Log::Severity::Info
            ::Log.setup "*", :warn, App::LOG_BACKEND
          else
            log_level = Log::Severity::Debug
            ::Log.setup "*", :info, App::LOG_BACKEND
          end
          Log.builder.bind "action-controller.*", log_level, App::LOG_BACKEND
          Log.builder.bind "#{App::NAME}.*", log_level, App::LOG_BACKEND
          
          
# Filter out sensitive params that shouldn't be logged
          filter_params = ["password", "bearer_token"]
          keeps_headers = ["X-Request-ID"]
          
          
# Add handlers that should run before your application
          ActionController::Server.before(
            ActionController::ErrorHandler.new(App.running_in_production?, keeps_headers),
            ActionController::LogHandler.new(filter_params),
            HTTP::CompressHandler.new
          )
          
          
# Optional support for serving of static assests

You can add additional log backends to a broadcast backend if you need logging going to multiple places too GitHub - place-labs/log-backend: Log backend in use across PlaceOS services

Topic		Replies	Views
Log Module Suggestions Crystal Contrib	9	711	April 17, 2020
How to Log Help & Support	11	409	July 3, 2023
Proposal to have all data be key/value data in Log Crystal Contrib	18	1032	May 13, 2020
Simple question about per class loging Help & Support	4	92	January 14, 2024
How to set a Formatter for Log? Help & Support	1	319	April 18, 2020

Filter sensitive data from `Log::Emitter`

Related Topics