Merge pull request #379 from Kuadrant/360-logs-show-plaintext-redis-p…

…assword-when-theres-connection-errors

logs with redacted password in URL

limitador-server/sandbox/.gitignore

@@ -3,4 +3,5 @@
 *.key
 *.pem
 *.csr
-report.html
+*.srl
+report.html

limitador-server/src/config.rs

@@ -15,7 +15,27 @@
 
 use crate::envoy_rls::server::RateLimitHeaders;
 use limitador::storage;
+use std::fmt;
 use tracing::level_filters::LevelFilter;
+use url::Url;
+
+pub fn redacted_url(url: String) -> String {
+ return match Url::parse(url.as_str()) {
+ Ok(url_object) => {
+ if url_object.password().is_some() {
+ let mut owned_url = url_object.clone();
+ if owned_url.set_password(Some("****")).is_ok() {
+ String::from(owned_url)
+ } else {
+ url.clone()
+ }
+ } else {
+ url.clone()
+ }
+ }
+ Err(_) => url.clone(),
+ };
+}
 
 #[derive(Debug)]
 pub struct Configuration {
@@ -164,12 +184,24 @@ pub struct DiskStorageConfiguration {
  pub optimization: storage::disk::OptimizeFor,
 }
 
-#[derive(PartialEq, Eq, Debug)]
+#[derive(PartialEq, Eq)]
 pub struct RedisStorageConfiguration {
  pub url: String,
  pub cache: Option<RedisStorageCacheConfiguration>,
 }
 
+impl fmt::Debug for RedisStorageConfiguration {
+ fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+ f.debug_struct("Foo")
+ .field("cache", &self.cache)
+ .field(
+ "url",
+ &format_args!("{}", redacted_url(self.url.clone()).as_str()),
+ )
+ .finish()
+ }
+}
+
 #[derive(PartialEq, Eq, Debug)]
 pub struct RedisStorageCacheConfiguration {
  pub batch_size: usize,

limitador-server/src/main.rs

@@ -8,7 +8,7 @@ extern crate clap;
 #[cfg(feature = "distributed_storage")]
 use crate::config::DistributedStorageConfiguration;
 use crate::config::{
- Configuration, DiskStorageConfiguration, InMemoryStorageConfiguration,
+ redacted_url, Configuration, DiskStorageConfiguration, InMemoryStorageConfiguration,
  RedisStorageCacheConfiguration, RedisStorageConfiguration, StorageConfiguration,
 };
 use crate::envoy_rls::server::{run_envoy_rls_server, RateLimitHeaders};
@@ -121,7 +121,8 @@ impl Limiter {
  AsyncRedisStorage::new(redis_url)
  .await
  .unwrap_or_else(|err| {
- eprintln!("Failed to connect to Redis at {redis_url}: {err}");
+ let redacted_redis_url = redacted_url(String::from(redis_url));
+ eprintln!("Failed to connect to Redis at {redacted_redis_url}: {err}");
  process::exit(1)
  })
  }
@@ -139,7 +140,8 @@ impl Limiter {
  .response_timeout(Duration::from_millis(cache_cfg.response_timeout));
 
  cached_redis_storage.build().await.unwrap_or_else(|err| {
- eprintln!("Failed to connect to Redis at {redis_url}: {err}");
+ let redacted_redis_url = redacted_url(String::from(redis_url));
+ eprintln!("Failed to connect to Redis at {redacted_redis_url}: {err}");
  process::exit(1)
  })
  }