summaryrefslogtreecommitdiffstats
path: root/Bugzilla
diff options
context:
space:
mode:
authorByron Jones <glob@mozilla.com>2015-08-18 08:27:51 +0200
committerByron Jones <glob@mozilla.com>2015-08-18 08:27:51 +0200
commit4812a79c03b9068c1d10a058e80c9f01e5b8aded (patch)
tree35f97e33883ba51e20e12099f44905a6e8948617 /Bugzilla
parentc8869c191947a49cc5c19d7c8799d24e3c8284b3 (diff)
downloadbugzilla-4812a79c03b9068c1d10a058e80c9f01e5b8aded.tar.gz
bugzilla-4812a79c03b9068c1d10a058e80c9f01e5b8aded.tar.xz
Bug 1195620 - stop sending http cookies to sentry
Diffstat (limited to 'Bugzilla')
-rw-r--r--Bugzilla/Sentry.pm39
1 files changed, 36 insertions, 3 deletions
diff --git a/Bugzilla/Sentry.pm b/Bugzilla/Sentry.pm
index 73f316a1d..e9dedc8dd 100644
--- a/Bugzilla/Sentry.pm
+++ b/Bugzilla/Sentry.pm
@@ -20,9 +20,11 @@ use Carp;
use DateTime;
use File::Temp;
use JSON ();
+use List::MoreUtils qw( any );
use LWP::UserAgent;
use Sys::Hostname;
use URI;
+use URI::QueryParam;
use Bugzilla::Constants;
use Bugzilla::RNG qw(irand);
@@ -210,9 +212,40 @@ sub sentry_handle_error {
my $uri = URI->new(Bugzilla->cgi->self_url);
$uri->query(undef);
- foreach my $field (qw( QUERY_STRING REQUEST_URI HTTP_REFERER )) {
- $ENV{$field} =~ s/\b((?:Bugzilla_password|password)=)[^ &]+/$1*/gi
- if exists $ENV{$field};
+ # sanitise
+
+ # sanitise these query-string params
+ # names are checked as-is as well as prefixed by BUGZILLA_
+ my @sanitise_params = qw( PASSWORD TOKEN API_KEY );
+
+ # remove these ENV vars
+ my @sanitise_vars = qw( HTTP_COOKIE HTTP_X_BUGZILLA_PASSWORD HTTP_X_BUGZILLA_API_KEY HTTP_X_BUGZILLA_TOKEN );
+
+ foreach my $var (qw( QUERY_STRING REDIRECT_QUERY_STRING )) {
+ next unless exists $ENV{$var};
+ my @pairs = split('&', $ENV{$var});
+ foreach my $pair (@pairs) {
+ next unless $pair =~ /^([^=]+)=(.+)$/;
+ my ($param, $value) = ($1, $2);
+ if (any { uc($param) eq $_ || uc($param) eq "BUGZILLA_$_" } @sanitise_params) {
+ $value = '*';
+ }
+ $pair = $param . '=' . $value;
+ }
+ $ENV{$var} = join('&', @pairs);
+ }
+ foreach my $var (qw( REQUEST_URI HTTP_REFERER )) {
+ next unless exists $ENV{$var};
+ my $uri = URI->new($ENV{$var});
+ foreach my $param ($uri->query_param) {
+ if (any { uc($param) eq $_ || uc($param) eq "BUGZILLA_$_" } @sanitise_params) {
+ $uri->query_param($param, '*');
+ }
+ }
+ $ENV{$var} = $uri->as_string;
+ }
+ foreach my $var (@sanitise_vars) {
+ delete $ENV{$var};
}
my $now = DateTime->now();