sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-14 18:59:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Log only scheme and host of the debug bundle upload URL

Browse Source 
The URL reaches the daemon from the management server or from the caller and can
carry userinfo or a token in its query. Both log lines wrote it whole, into the
file that then ships inside the very bundles this uploads.

Reported by CodeRabbit (CWE-532) and cubic on #7514.
This commit is contained in:
riccardom
2026-09-14 09:16:51 +02:00
parent 803b0d6db0
commit 82aa7f7b04
1 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/server/debug.go
+15 -2
View File
@@ -7,6 +7,7 @@ import (
"context"
"errors"
"fmt"
"net/url"
"path/filepath"
"runtime/pprof"
"strings"
@@ -57,15 +58,27 @@ func (s *Server) DebugBundle(callerCtx context.Context, req *proto.DebugBundleRe
defer cancel()
key, err := debug.UploadDebugBundle(uploadCtx, uploadURL, managementURL, path, req.GetUploadInsecure())
if err != nil {
log.Errorf("failed to upload debug bundle to %s: %v", uploadURL, err)
log.Errorf("failed to upload debug bundle to %s: %v", redactUploadURL(uploadURL), err)
return &proto.DebugBundleResponse{Path: path, UploadFailureReason: err.Error()}, nil
}
log.Infof("debug bundle uploaded to %s with key %s", uploadURL, key)
log.Infof("debug bundle uploaded to %s with key %s", redactUploadURL(uploadURL), key)
return &proto.DebugBundleResponse{Path: path, UploadedKey: key}, nil
}
// redactUploadURL reduces an upload URL to scheme://host for logging. The URL
// reaches the daemon from the management server or the caller and can carry
// userinfo or a token in its query, neither of which belongs in a log file that
// ends up inside the very bundles this uploads.
func redactUploadURL(raw string) string {
parsed, err := url.Parse(raw)
if err != nil || parsed.Host == "" {
return "(unparsable upload URL)"
}
return parsed.Scheme + "://" + parsed.Host
}
// generateDebugBundle builds the bundle under s.mutex and returns its path plus
// the management URL and the upload service the management server publishes,
// both captured under the lock, so the caller can run the upload without