Filter out Basic Authorization tokens

We filter out Bearer / SharedKey tokens from the log output but Basic authorization tokens were not being filtered out. CVE-2023-46175
ManageIQ · Nov 17, 2023 · e8cb103 · e8cb103
1 parent 0c52733
commit e8cb103
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 16 deletions.
diff --git a/lib/vmdb/loggers/provider_sdk_logger.rb b/lib/vmdb/loggers/provider_sdk_logger.rb
@@ -17,6 +17,7 @@ def <<(msg)
     class Formatter < ManageIQ::Loggers::Base::Formatter
       def call(severity, datetime, progname, msg)
         msg = msg.sub(/Bearer(.*?)\"/, 'Bearer [FILTERED] "')
+        msg = msg.sub(/Basic(.*?)\"/, 'Basic [FILTERED] "')
         msg = msg.sub(/SharedKey(.*?)\"/, 'SharedKey [FILTERED] "')
         msg = msg.sub(/client_secret=(.*?)&/, "client_secret=[FILTERED]&")
         msg = msg.sub(/apikey=(.*?)\"/, 'apikey=[FILTERED]"')

diff --git a/spec/lib/vmdb/loggers/provider_sdk_logger_spec.rb b/spec/lib/vmdb/loggers/provider_sdk_logger_spec.rb
@@ -4,23 +4,27 @@
     @log = described_class.new(@log_stream)
   end
 
-  context "azure" do
-    it "filters out bearer tokens" do
-      @log.log(@log.level, 'Bearer abcd1234 "stuff"')
-      @log_stream.rewind
-      expect(@log_stream.read).to match(Regexp.quote('Bearer [FILTERED] "stuff"'))
-    end
+  it "filters out bearer tokens" do
+    @log.log(@log.level, 'Bearer abcd1234 "stuff"')
+    @log_stream.rewind
+    expect(@log_stream.read).to match(Regexp.quote('Bearer [FILTERED] "stuff"'))
+  end
+
+  it "filters out basic tokens" do
+    @log.log(@log.level, 'Authorization: "Basic abcd1234"')
+    @log_stream.rewind
+    expect(@log_stream.read).to match(Regexp.quote('Authorization: "Basic [FILTERED] "'))
+  end
 
-    it "filters out sharedkey tokens" do
-      @log.log(@log.level, 'SharedKey xxx123 "stuff"')
-      @log_stream.rewind
-      expect(@log_stream.read).to match(Regexp.quote('SharedKey [FILTERED] "stuff"'))
-    end
+  it "filters out sharedkey tokens" do
+    @log.log(@log.level, 'SharedKey xxx123 "stuff"')
+    @log_stream.rewind
+    expect(@log_stream.read).to match(Regexp.quote('SharedKey [FILTERED] "stuff"'))
+  end
 
-    it "filters out client secret tokens" do
-      @log.log(@log.level, 'client_secret=abc123&management=yadayada')
-      @log_stream.rewind
-      expect(@log_stream.read).to match(Regexp.quote('client_secret=[FILTERED]&management=yadayada'))
-    end
+  it "filters out client secret tokens" do
+    @log.log(@log.level, 'client_secret=abc123&management=yadayada')
+    @log_stream.rewind
+    expect(@log_stream.read).to match(Regexp.quote('client_secret=[FILTERED]&management=yadayada'))
   end
 end