mirror of
https://github.com/nextcloud/server.git
synced 2026-10-24 12:17:23 +02:00
Côme Chilliet
7b64247878
Parameters flagged with this attribute are now handled like methods flagged as sensitive in Nextcloud: Their value is stacktraces is replace with the same placeholder (instead of '[class => SensitiveParameterValue]'). And their value is tracked and removed from the rest of the stacktrace. Meaning if another function is called on the parameter it gets removed there as well. Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
96 lines
3.2 KiB
PHP
96 lines
3.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
/**
|
|
* SPDX-FileCopyrightText: 2021 Nextcloud GmbH and Nextcloud contributors
|
|
* SPDX-License-Identifier: AGPL-3.0-or-later
|
|
*/
|
|
|
|
namespace lib\Log;
|
|
|
|
use OC\Log\ExceptionSerializer;
|
|
use OC\SystemConfig;
|
|
use Test\TestCase;
|
|
|
|
class ExceptionSerializerTest extends TestCase {
|
|
private ExceptionSerializer $serializer;
|
|
|
|
#[\Override]
|
|
public function setUp(): void {
|
|
parent::setUp();
|
|
|
|
$config = $this->createMock(SystemConfig::class);
|
|
$this->serializer = new ExceptionSerializer($config);
|
|
}
|
|
|
|
private function emit($arguments) {
|
|
\call_user_func_array([$this, 'bind'], $arguments);
|
|
}
|
|
|
|
private function bind(array &$myValues): void {
|
|
throw new \Exception('my exception');
|
|
}
|
|
|
|
private function customMagicAuthThing(string $login, string $parole): void {
|
|
$this->throwsException($parole);
|
|
}
|
|
|
|
private function customSensitiveParameter(
|
|
string $login,
|
|
#[\SensitiveParameter]
|
|
string $password,
|
|
): void {
|
|
$this->throwsException($password);
|
|
}
|
|
|
|
private function throwsException(string $maybeSecret): void {
|
|
throw new \Exception('expected exception');
|
|
}
|
|
|
|
/**
|
|
* this test ensures that the serializer does not overwrite referenced
|
|
* variables. It is crafted after a scenario we experienced: the DAV server
|
|
* emitting the "validateTokens" event, of which later on a handled
|
|
* exception was passed to the logger. The token was replaced, the original
|
|
* variable overwritten.
|
|
*/
|
|
public function testSerializer(): void {
|
|
try {
|
|
$secret = ['Secret'];
|
|
$this->emit([&$secret]);
|
|
} catch (\Exception $e) {
|
|
$serializedData = $this->serializer->serializeException($e);
|
|
$this->assertSame(['Secret'], $secret);
|
|
$this->assertSame(ExceptionSerializer::SENSITIVE_VALUE_PLACEHOLDER, $serializedData['Trace'][0]['args'][0]);
|
|
}
|
|
}
|
|
|
|
public function testSerializerWithRegisteredMethods(): void {
|
|
$this->serializer->enlistSensitiveMethods(self::class, ['customMagicAuthThing']);
|
|
try {
|
|
$this->customMagicAuthThing('u57474', 'Secret');
|
|
} catch (\Exception $e) {
|
|
$serializedData = $this->serializer->serializeException($e);
|
|
$this->assertSame('throwsException', $serializedData['Trace'][0]['function']);
|
|
$this->assertSame(ExceptionSerializer::SENSITIVE_VALUE_PLACEHOLDER, $serializedData['Trace'][0]['args'][0]);
|
|
$this->assertSame('customMagicAuthThing', $serializedData['Trace'][1]['function']);
|
|
$this->assertSame(ExceptionSerializer::SENSITIVE_VALUE_PLACEHOLDER, $serializedData['Trace'][1]['args'][0]);
|
|
$this->assertFalse(isset($serializedData['Trace'][1]['args'][1]));
|
|
}
|
|
}
|
|
|
|
public function testSerializerWithSensitiveParameter(): void {
|
|
try {
|
|
$this->customSensitiveParameter('login', 'Secret');
|
|
} catch (\Exception $e) {
|
|
$serializedData = $this->serializer->serializeException($e);
|
|
$this->assertSame('throwsException', $serializedData['Trace'][0]['function']);
|
|
$this->assertSame(ExceptionSerializer::SENSITIVE_VALUE_PLACEHOLDER, $serializedData['Trace'][0]['args'][0]);
|
|
$this->assertSame('customSensitiveParameter', $serializedData['Trace'][1]['function']);
|
|
$this->assertSame('login', $serializedData['Trace'][1]['args'][0]);
|
|
$this->assertSame(ExceptionSerializer::SENSITIVE_VALUE_PLACEHOLDER, $serializedData['Trace'][1]['args'][1]);
|
|
}
|
|
}
|
|
}
|