nextcloud-server-mirror/lib/private/Log/ExceptionSerializer.php

<?php

/**
 * SPDX-FileCopyrightText: 2018 Nextcloud GmbH and Nextcloud contributors
 * SPDX-License-Identifier: AGPL-3.0-or-later
 */

namespace OC\Log;

use OC\SystemConfig;
use OCP\HintException;

class ExceptionSerializer {
	public const SENSITIVE_VALUE_PLACEHOLDER = '*** sensitive parameters replaced ***';

	public const methodsWithSensitiveParameters = [
		// Session/User
		'completeLogin',
		'login',
		'checkPassword',
		'checkPasswordNoLogging',
		'loginWithPassword',
		'updatePrivateKeyPassword',
		'validateUserPass',
		'loginWithToken',
		'{closure}',
		'{closure:*',
		'createSessionToken',

		// Provisioning
		'addUser',

		// TokenProvider
		'getToken',
		'isTokenPassword',
		'getPassword',
		'decryptPassword',
		'logClientIn',
		'generateToken',
		'validateToken',

		// TwoFactorAuth
		'solveChallenge',
		'verifyChallenge',

		// ICrypto
		'calculateHMAC',
		'encrypt',
		'decrypt',

		// LoginController
		'tryLogin',
		'confirmPassword',

		// LDAP
		'bind',
		'areCredentialsValid',
		'invokeLDAPMethod',

		// Encryption
		'storeKeyPair',
		'setupUser',
		'checkSignature',

		// files_external: OCA\Files_External\MountConfig
		'getBackendStatus',

		// files_external: UserStoragesController
		'update',

		// Preview providers, don't log big data strings
		'imagecreatefromstring',

		// text: PublicSessionController, SessionController and ApiService
		'create',
		'close',
		'push',
		'sync',
		'updateSession',
		'mention',
		'loginSessionUser',
	];

	public function __construct(
		private SystemConfig $systemConfig,
	) {
	}

	protected array $methodsWithSensitiveParametersByClass = [];

	private function editTrace(array &$sensitiveValues, array $traceLine): array {
		if (isset($traceLine['args'])) {
			$sensitiveValues = array_merge($sensitiveValues, $traceLine['args']);
		}
		$traceLine['args'] = [self::SENSITIVE_VALUE_PLACEHOLDER];
		return $traceLine;
	}

	private function processSensitiveParameterValues(array &$sensitiveValues, array $traceLine): array {
		if (isset($traceLine['args'])) {
			foreach ($traceLine['args'] as &$arg) {
				if ($arg instanceof \SensitiveParameterValue) {
					$sensitiveValues[] = $arg->getValue();
					$arg = self::SENSITIVE_VALUE_PLACEHOLDER;
				}
			}
		}
		return $traceLine;
	}

	private function filterTrace(array $trace) {
		$sensitiveValues = [];
		$trace = array_map(function (array $traceLine) use (&$sensitiveValues) {
			$className = $traceLine['class'] ?? '';
			if ($className && isset($this->methodsWithSensitiveParametersByClass[$className])
				&& in_array($traceLine['function'], $this->methodsWithSensitiveParametersByClass[$className], true)) {
				return $this->editTrace($sensitiveValues, $traceLine);
			}
			foreach (self::methodsWithSensitiveParameters as $sensitiveMethod) {
				if (str_contains($traceLine['function'], $sensitiveMethod)
					|| (str_ends_with($sensitiveMethod, '*')
						&& str_starts_with($traceLine['function'], substr($sensitiveMethod, 0, -1)))) {
					return $this->editTrace($sensitiveValues, $traceLine);
				}
			}
			return $this->processSensitiveParameterValues($sensitiveValues, $traceLine);
		}, $trace);
		return array_map(function (array $traceLine) use ($sensitiveValues) {
			if (isset($traceLine['args'])) {
				$traceLine['args'] = $this->removeValuesFromArgs($traceLine['args'], $sensitiveValues);
			}
			return $traceLine;
		}, $trace);
	}

	private function removeValuesFromArgs(array $args, array $values): array {
		$workArgs = [];
		foreach ($args as $key => $arg) {
			if (in_array($arg, $values, true)) {
				$arg = self::SENSITIVE_VALUE_PLACEHOLDER;
			} elseif (is_array($arg)) {
				$arg = $this->removeValuesFromArgs($arg, $values);
			}
			$workArgs[$key] = $arg;
		}
		return $workArgs;
	}

	private function encodeTrace(array $trace): array {
		$trace = array_map(function (array $line) {
			if (isset($line['args'])) {
				$line['args'] = array_map($this->encodeArg(...), $line['args']);
			}
			return $line;
		}, $trace);
		return $this->filterTrace($trace);
	}

	private function encodeArg(mixed $arg, int $nestingLevel = 5): mixed {
		if (is_object($arg)) {
			if ($arg instanceof \SensitiveParameterValue) {
				// Keep SensitiveParameterValue as-is, it will be handled later
				return $arg;
			}
			if ($nestingLevel === 0) {
				return [
					'__class__' => get_class($arg),
					'__properties__' => 'Encoding skipped as the maximum nesting level was reached',
				];
			}

			$objectInfo = [ '__class__' => get_class($arg) ];
			$objectVars = get_object_vars($arg);
			return array_map(function ($arg) use ($nestingLevel) {
				return $this->encodeArg($arg, $nestingLevel - 1);
			}, array_merge($objectInfo, $objectVars));
		}

		if (is_array($arg)) {
			if ($nestingLevel === 0) {
				return ['Encoding skipped as the maximum nesting level was reached'];
			}

			// Only log the first 5 elements of an array unless we are on debug
			if ((int)$this->systemConfig->getValue('loglevel', 2) !== 0) {
				$elemCount = count($arg);
				if ($elemCount > 5) {
					$arg = array_slice($arg, 0, 5);
					$arg[] = 'And ' . ($elemCount - 5) . ' more entries, set log level to debug to see all entries';
				}
			}
			return array_map(function ($e) use ($nestingLevel) {
				return $this->encodeArg($e, $nestingLevel - 1);
			}, $arg);
		}

		return $arg;
	}

	public function serializeException(\Throwable $exception): array {
		$data = [
			'Exception' => get_class($exception),
			'Message' => $exception->getMessage(),
			'Code' => $exception->getCode(),
			'Trace' => $this->encodeTrace($exception->getTrace()),
			'File' => $exception->getFile(),
			'Line' => $exception->getLine(),
		];

		if ($exception instanceof HintException) {
			$data['Hint'] = $exception->getHint();
		}

		if ($exception->getPrevious()) {
			$data['Previous'] = $this->serializeException($exception->getPrevious());
		}

		return $data;
	}

	public function enlistSensitiveMethods(string $class, array $methods): void {
		if (!isset($this->methodsWithSensitiveParametersByClass[$class])) {
			$this->methodsWithSensitiveParametersByClass[$class] = [];
		}
		$this->methodsWithSensitiveParametersByClass[$class] = array_merge($this->methodsWithSensitiveParametersByClass[$class], $methods);
	}
}