Module: Clavis::Security::ParameterFilter

Defined in:
lib/clavis/security/parameter_filter.rb

Constant Summary collapse

SENSITIVE_PARAMETERS = 
[
  :code,           # Authorization code
  :token,          # Access token
  :access_token,   # Access token
  :refresh_token,  # Refresh token
  :id_token,       # ID token
  :client_secret,  # Client secret
  :state,          # CSRF state token
  :nonce,          # OIDC nonce
  :password,       # Just in case
  :secret          # Generic secret
].freeze

Class Method Summary collapse

Class Method Details

.filter_parameters(params) ⇒ Hash Also known as: filter_params

Filters sensitive parameters from a hash

Parameters:

  • params (Hash) —

    The parameters to filter

Returns:

  • (Hash) —

    The filtered parameters



23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/clavis/security/parameter_filter.rb', line 23

def filter_parameters(params)
  return params unless Clavis.configuration.parameter_filter_enabled
  return params if params.nil? || !params.is_a?(Hash)

  filtered_params = params.dup
  SENSITIVE_PARAMETERS.each do |param|
    filtered_params[param] = "[FILTERED]" if filtered_params.key?(param)

    # Also check for string keys
    string_param = param.to_s
    filtered_params[string_param] = "[FILTERED]" if filtered_params.key?(string_param)
  end

  filtered_params
end

.install_rails_filter ⇒ Object

Installs the parameter filter in Rails if available This should be called during initialization



44
45
46
47
48
49
 
# File 'lib/clavis/security/parameter_filter.rb', line 44

def install_rails_filter
  return unless defined?(Rails) && Rails.application&.config.respond_to?(:filter_parameters)

  Rails.application.config.filter_parameters.concat(SENSITIVE_PARAMETERS)
  Clavis.logger.info("Installed Clavis parameter filters in Rails")
end

.log_parameters(params, level: :debug, message: "Parameters") ⇒ Object

Logs parameters safely by filtering sensitive values

Parameters:

  • params (Hash) —

    The parameters to log

  • level (Symbol) (defaults to: :debug) —

    The log level (:info, :debug, etc.)

  • message (String) (defaults to: "Parameters") —

    The message to log



55
56
57
58
59
60
 
# File 'lib/clavis/security/parameter_filter.rb', line 55

def log_parameters(params, level: :debug, message: "Parameters")
  return unless Clavis.logger

  filtered = filter_parameters(params)
  Clavis.logger.send(level, "#{message}: #{filtered.inspect}")
end