Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prevent Sensitive Information in ToString() Overrides of HTTP Classes #97

Closed
hamzamahmood opened this issue Dec 17, 2024 · 0 comments · Fixed by #98
Closed

Prevent Sensitive Information in ToString() Overrides of HTTP Classes #97

hamzamahmood opened this issue Dec 17, 2024 · 0 comments · Fixed by #98
Assignees
@hamzamahmood
Labels
bug Something isn't working

Comments

@hamzamahmood
Copy link
Collaborator

The current ToString() overrides in HTTP-related classes (e.g., HttpContext, HttpRequest, HttpResponse) risk exposing sensitive information.

To mitigate this risk, we propose removing the overridden ToString() methods in these classes and instead utilizing the logging framework for request and response logging. Logging provides support for masking or excluding sensitive headers and information.
@hamzamahmood hamzamahmood added the bug Something isn't working label Dec 17, 2024
@hamzamahmood hamzamahmood self-assigned this Dec 17, 2024
hamzamahmood added a commit that referenced this issue Dec 17, 2024
@hamzamahmood
fix(http-to-string): remove ToString() overrides
8ea482b 
- Removed ToString() overrides from HttpContext, HttpRequest, and HttpResponse to prevent exposure of sensitive information.
- Bump package System.Net.Http.Json in test project due to reported vulnerability

Closes #97
@hamzamahmood hamzamahmood mentioned this issue Dec 17, 2024
Merged
8 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@hamzamahmood hamzamahmood

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(http-to-string): remove ToString() overrides apimatic/core-lib-csharp
1 participant
@hamzamahmood