http: Redact credential headers in logs (#5330)

* http: Redact credential headers in logs

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* http: Skip logging credential headers instead of redacting them

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
This commit is contained in:
Henrique Reis Neves
2026-10-09 16:08:22 -05:00
committed by GitHub
co-authored by Claude Opus 5.5
parent 437dc7eb8f
commit f1d5d5d63a
+18 -4
View File
@@ -214,6 +214,7 @@ static bool ResolveEpollBinding(int id, int*& epoll_id_out, void**& user_arg_out
}
static bool HeaderNameMatches(std::string_view a, std::string_view b);
static bool IsCredentialHeader(std::string_view name);
static std::string HttpStatusLabel(int sc);
// JSON shape: flat object mapping endpoint -> replacement URL. Example:
@@ -566,6 +567,9 @@ static void LogSendRequestSettings(const HttpRequest& req, int reqId, u64 body_s
return;
}
for (const auto& [name, value] : h) {
if (IsCredentialHeader(name)) {
continue;
}
LOG_INFO(Lib_Http, " header[{}] {}: {}", origin, name, value);
}
};
@@ -1081,6 +1085,11 @@ static bool HeaderNameMatches(std::string_view a, std::string_view b) {
return true;
}
static bool IsCredentialHeader(std::string_view name) {
return HeaderNameMatches(name, "Authorization") ||
HeaderNameMatches(name, "Proxy-Authorization") || HeaderNameMatches(name, "Cookie");
}
static std::string GetLibhttpSystemVersionString() {
constexpr u32 sw_hex = CURRENT_FIRMWARE_VERSION;
const u32 major = ((sw_hex >> 0x18) & 0xf) + ((sw_hex >> 0x1c) * 10);
@@ -2814,8 +2823,11 @@ int PS4_SYSV_ABI sceHttpSetInflateGZIPEnabled(int id, int isEnable) {
// Http Header setting functions
//***********************************
int PS4_SYSV_ABI sceHttpAddRequestHeader(int id, const char* name, const char* value, s32 mode) {
LOG_INFO(Lib_Http, "called id={}, name={}, value={}, mode={}", id, name ? name : "(null)",
value ? value : "(null)", mode);
const bool is_credential_header = name && IsCredentialHeader(name);
if (!is_credential_header) {
LOG_INFO(Lib_Http, "called id={}, name={}, value={}, mode={}", id, name ? name : "(null)",
value ? value : "(null)", mode);
}
std::lock_guard<std::mutex> lock(g_state.m_mutex);
if (!g_state.inited) {
LOG_ERROR(Lib_Http, "Not initialized");
@@ -2842,8 +2854,10 @@ int PS4_SYSV_ABI sceHttpAddRequestHeader(int id, const char* name, const char* v
headers->end());
}
headers->emplace_back(name, value);
LOG_INFO(Lib_Http, "added header at {} id={}: {}: {} (mode={}, total now {})", level, id, name,
value, mode, headers->size());
if (!is_credential_header) {
LOG_INFO(Lib_Http, "added header at {} id={}: {}: {} (mode={}, total now {})", level, id,
name, value, mode, headers->size());
}
return ORBIS_OK;
}