From f2f85ba093df5dcd991fd206af4d79d57f4c7fc8 Mon Sep 17 00:00:00 2001
From: Kitsune Ral <Kitsune-Ral@users.sf.net>
Date: Tue, 17 Oct 2017 17:13:31 +0900
Subject: Avoid leaking access_token in the logs

Closes #102.
---
 jobs/basejob.cpp | 13 +++++++++----
 jobs/basejob.h   |  1 +
 2 files changed, 10 insertions(+), 4 deletions(-)

(limited to 'jobs')

diff --git a/jobs/basejob.cpp b/jobs/basejob.cpp
index 240192d9..eb78dec8 100644
--- a/jobs/basejob.cpp
+++ b/jobs/basejob.cpp
@@ -24,6 +24,7 @@
 #include <QtNetwork/QNetworkRequest>
 #include <QtNetwork/QNetworkReply>
 #include <QtCore/QTimer>
+#include <QtCore/QRegularExpression>
 //#include <QtCore/QStringBuilder>
 
 #include <array>
@@ -79,6 +80,13 @@ inline QDebug operator<<(QDebug dbg, const BaseJob* j)
     return dbg << j->objectName();
 }
 
+QDebug QMatrixClient::operator<<(QDebug dbg, const BaseJob::Status& s)
+{
+    QRegularExpression filter { "(access_token)=[-_A-Za-z0-9]+" };
+    return dbg << s.code << ':'
+               << QString(s.message).replace(filter, "\1=HIDDEN");
+}
+
 BaseJob::BaseJob(HttpVerb verb, const QString& name, const QString& endpoint,
                  const Query& query, const Data& data, bool needsToken)
     : d(new Private(verb, endpoint, query, data, needsToken))
@@ -331,10 +339,7 @@ void BaseJob::setStatus(Status s)
 {
     d->status = s;
     if (!s.good())
-    {
-        qCWarning(d->logCat) << this << "status" << s.code
-                                     << ":" << s.message;
-    }
+        qCWarning(d->logCat) << this << "status" << s;
 }
 
 void BaseJob::setStatus(int code, QString message)
diff --git a/jobs/basejob.h b/jobs/basejob.h
index 2f7bd9cd..f8b367c6 100644
--- a/jobs/basejob.h
+++ b/jobs/basejob.h
@@ -110,6 +110,7 @@ namespace QMatrixClient
                     Status(int c, QString m) : code(c), message(std::move(m)) { }
 
                     bool good() const { return code < ErrorLevel; }
+                    friend QDebug operator<<(QDebug dbg, const Status& s);
 
                     int code;
                     QString message;
-- 
cgit v1.2.3