Class: Dommy::Rack::Trace::ParamFilter

Inherits:
Object
  • Object
show all
Defined in:
lib/dommy/rack/trace/param_filter.rb

Overview

Masks sensitive form / request parameters by key name before they land in a trace artifact. A key whose name matches any configured matcher (Regexp or exact String) has its value replaced with FILTERED. Owns the masking policy so the Trace only decides when to record params, not how to redact them.

Constant Summary collapse

DEFAULT =

Parameter names matching any of these are masked so a password / token never lands in a trace artifact. Construct with your own matchers to override (dommy-rails passes Rails' filter_parameters).

[/pass/i, /secret/i, /token/i, /api[-_]?key/i, /auth/i, /csrf/i].freeze
FILTERED = 
"[FILTERED]"

Instance Method Summary collapse

Constructor Details

#initialize(matchers = DEFAULT) ⇒ ParamFilter

Returns a new instance of ParamFilter.



18
19
20
 
# File 'lib/dommy/rack/trace/param_filter.rb', line 18

def initialize(matchers = DEFAULT)
  @matchers = matchers
end

Instance Method Details

#filtered?(key) ⇒ Boolean

Returns:

  • (Boolean) 


46
47
48
49
 
# File 'lib/dommy/rack/trace/param_filter.rb', line 46

def filtered?(key)
  name = key.to_s
  @matchers.any? { |matcher| matcher.is_a?(Regexp) ? matcher.match?(name) : name == matcher.to_s }
end

#form_params(params) ⇒ Object

Turn ordered [name, value] form pairs into a masked hash. A non-pairs shape (already a hash / scalar) falls through to recursive masking.



24
25
26
27
28
29
30
 
# File 'lib/dommy/rack/trace/param_filter.rb', line 24

def form_params(params)
  return mask(params) unless ordered_pairs?(params)

  params.each_with_object({}) do |(name, value), out|
    out[name] = filtered?(name) ? FILTERED : value
  end
end

#mask(params) ⇒ Object

Recursively mask sensitive values by key name.



33
34
35
36
37
38
39
40
41
42
43
44
 
# File 'lib/dommy/rack/trace/param_filter.rb', line 33

def mask(params)
  case params
  when Hash
    params.each_with_object({}) do |(key, value), out|
      out[key] = filtered?(key) ? FILTERED : mask(value)
    end
  when Array
    params.map { |value| mask(value) }
  else
    params
  end
end