fix(weather): keep the request URL out of transport errors - #137
Merged
Conversation
The status-code branch composes its message from host and path alone, with the reason written beside it: to keep coordinates and search terms out of the logs. The transport branch two lines above defeated that. net/http returns a *url.Error whose Error() embeds the URL verbatim, so a plain dial timeout arrived carrying every latitude, longitude and query term the request was built with, and any caller formatting it with %v printed them. Three call sites inherited it: Forecast, Geocode and ForecastRange. Rebuild the *url.Error with host and path only. A URL that will not parse redacts to nothing rather than to itself — the point is that nothing unexamined reaches the log. Closes #133 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U6jNuzK5PZrhDWBxB3t2gY
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The status-code branch in
OpenMeteo.attemptcomposes its message from host and path alone,with the reason written beside it — to keep coordinates and search terms out of the logs. The
transport branch two lines above defeated it.
net/httpreturns a*url.ErrorwhoseError()embeds the request URL verbatim, sois what any caller formatting the error with
%vprinted. Three call sites inherited it:ForecastandForecastRangewith coordinates,Geocodewith the term the user typed.Both are pre-approved data under
beacon-data-privacy, and no line carries a useridentifier, so this is hygiene rather than a policy breach — but it defeated an intent the
code states out loud, in three places.
redactURLErrorrebuilds the*url.Errorwith host and path only. A URL that will not parseredacts to the empty string rather than to itself: the point is that nothing unexamined
reaches the log.
Tests cover both real paths — a forecast and a geocode against a dead listener, asserting the
coordinates and the search term are gone while the path survives so the line still says what
failed — plus the non-
*url.Errorpassthrough and the unparseable URL. Both transport caseswere verified to fail with the redaction removed.
The privacy skill gains the general rule, since the next outbound client will need it:
an outbound URL is a log field.
Refs #133