SYN-6783: redact sensitive fields in response and error debug details - #51
Draft
jcsco wants to merge 1 commit into
Draft
SYN-6783: redact sensitive fields in response and error debug details#51jcsco wants to merge 1 commit into
jcsco wants to merge 1 commit into
Conversation
RequestDetails.ResponseBody and error responses from makePublicAPICall previously passed sensitive API response fields (secrets, certificate content, passwords) through with no redaction. Add a sanitized copy of the response body for debug purposes and redact the error path's Details map, while leaving the raw ResponseBody untouched so existing parse*Response call sites keep unmarshaling real values into typed structs and Terraform state. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RequestDetails.ResponseBodyand API error responses frommakePublicAPICallpreviously carried sensitive fields (secrets, certificate content, passwords) with no redaction, unlikeRequestBodywhich is already sanitized.RequestDetails.SanitizedResponseBody, a redacted copy of the response body for debug/logging use, reusing the existingredactSensitiveJSONFields/sensitiveJSONFieldNamesmachinery.errorResponse.Detailsmap before it's embedded in the returned error string.ResponseBodyfield is intentionally left unredacted, because everyparse*Response(details.ResponseBody)call site unmarshals that exact string into typed structs that back Terraform state (e.g.Variable.Value,TotpVariable.Secret,ClientCertificatePrivateKey.Content/Password). Redacting it in place would silently corrupt real values returned to callers — non-secretVariable.Valuehas no fallback at all, and TOTP/certificate secrets already rely on the API's own"<REDACTED>"sentinel plus provider-side fallback logic (totpVariableSecretForState,stateOrAPISecret,caCertificateContentForState) that expects that exact marker. A new[REDACTED]marker written into the parsed value would defeat that fallback and persist the literal string into state. Redacting only the new debug-only copy avoids that regression while still hardening what gets logged/surfaced in errors.Test plan
go build -tags=unit_tests ./...go test ./syntheticsclientv2/... -tags=unit_tests -timeout=30s -parallel=8 -cover— all existing + new tests pass, coverage 73.6% → 73.8%TestMakePublicAPICallRedactsSensitiveFieldsInSanitizedResponseBody,TestMakePublicAPICallSanitizedResponseBodyHandlesEmptyAndMalformedBodies,TestMakePublicAPICallRedactsErrorResponseDetailsgolangci-lintnot available in this environment;go vet ./...andgofmt -l .are clean🤖 Generated with Claude Code