-
Bug
-
Resolution: Done
-
Normal
-
quay-v3.13.0
One password field in logs was not obfuscated.
gunicorn-web stdout | 2025-02-08 15:29:53,020 [268] [DEBUG] [app] Ending request: urn:request:ec8e7a77-a733-47ae-ad40-a3232df4c31a (/api/v1/user/) {'endpoint': 'api.user', 'request_id': 'urn:request:ec8e7a77-a733-47ae-ad40-a3232df4c31a', 'remote_addr': 'HOSTNAME', 'http_method': 'POST', 'original_url': 'http://HOSTNAME/api/v1/user/', 'path': '/api/v1/user/', 'parameters': {}, 'json_body': {'password': '[FILTERED]', 'username': 'user1', 'email': 'user1@user', 'repeatPassword': 'password'}, 'confsha': '55399261', 'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:134.0) Gecko/20100101 Firefox/134.0'}
While we filter out the password field, we don't filter repeatPassword field. We need to filter that one as well.
- links to
-
RHBA-2025:146347 Red Hat Quay v3.14.0 bug fix release