diff --git a/config/initializers/filter_parameter_logging.rb b/config/initializers/filter_parameter_logging.rb index c010b83ddd..89d5ec6d24 100644 --- a/config/initializers/filter_parameter_logging.rb +++ b/config/initializers/filter_parameter_logging.rb @@ -4,5 +4,5 @@ # Use this to limit dissemination of sensitive information. # See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors. Rails.application.config.filter_parameters += [ - :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn + :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :authoriz ] diff --git a/lib/seek/config.rb b/lib/seek/config.rb index 7159b2ba61..38ce9f60c7 100644 --- a/lib/seek/config.rb +++ b/lib/seek/config.rb @@ -110,7 +110,7 @@ def configure_recaptcha_keys end def configure_exception_notification - if exception_notification_enabled && Rails.env.production? + if exception_notification_enabled ExceptionNotification.configure do |config| config.ignored_exceptions = ['ActionDispatch::Http::Parameters::ParseError', 'ActionController::InvalidAuthenticityToken', diff --git a/lib/seek/errors/controller_error_handling.rb b/lib/seek/errors/controller_error_handling.rb index e5af939926..4c63801977 100644 --- a/lib/seek/errors/controller_error_handling.rb +++ b/lib/seek/errors/controller_error_handling.rb @@ -13,12 +13,11 @@ module ControllerErrorHandling }.freeze def self.included(base) - unless Rails.application.config.consider_all_requests_local - base.rescue_from Exception, with: :render_application_error - end + base.rescue_from Exception, with: :render_application_error end def render_application_error(exception) + raise exception if Rails.application.config.consider_all_requests_local logger.error "ERROR - #{exception.class.name} (#{exception.message})" status = error_response_code(exception) exception_notification(status, exception) diff --git a/lib/seek/errors/exception_forwarder.rb b/lib/seek/errors/exception_forwarder.rb index e9dd221de8..df60aef562 100644 --- a/lib/seek/errors/exception_forwarder.rb +++ b/lib/seek/errors/exception_forwarder.rb @@ -7,15 +7,15 @@ class ExceptionForwarder # the option :data will get merged with some default info that reports the configured site host, and current user # information def self.send_notification(exception, options = {}, user = User.current_user) - Rails.logger.error "Sending execption ERROR - #{exception.class.name} (#{exception.message})" + Rails.logger.error "Sending exception ERROR - #{exception.class.name} (#{exception.message})" return unless Seek::Config.exception_notification_enabled env = options[:env] data = default_data(user).merge(options[:data] || {}) begin ExceptionNotifier.notify_exception(exception, env: env, data: data) - rescue StandardError => deliver_exception - Rails.logger.error 'Error delivering exception email - ' \ - "#{deliver_exception.class.name} (#{deliver_exception.message})" + rescue StandardError => deliver_exception + Rails.logger.error 'Error delivering exception email - ' \ + "#{deliver_exception.class.name} (#{deliver_exception.message})" end end diff --git a/test/integration/exception_notification_test.rb b/test/integration/exception_notification_test.rb new file mode 100644 index 0000000000..0734fa6043 --- /dev/null +++ b/test/integration/exception_notification_test.rb @@ -0,0 +1,38 @@ +require 'test_helper' +require 'minitest/mock' + +class ExceptionNotificationTest < ActionDispatch::IntegrationTest + test 'filters sensitive parameters out of exception notifications' do + with_config_values(email_enabled: true, + exception_notification_enabled: true, + exception_notification_recipients: 'no-reply@sysmo-db.org') do + emails = capture_emails do + User.stub(:admin_logged_in?, true) do + Rails.application.config.stub(:consider_all_requests_local, false) do + get fail_path, params: { http_code: '500', + password: 'unique_string_2', + email: 'unique_string_3', + unfiltered_param: 'unique_string_4', + author: 'unique_string_5' + }, as: :json, headers: { + 'Accept' => 'application/vnd.api+json', + 'Authorization' => 'Token unique_string_1' + } + end + end + end + + assert_equal 1, emails.length + email = emails.last + body = email.body.to_s + + assert_includes body, 'A NoMethodError occurred in fail' + assert_not_includes body, 'unique_string_1' + assert_not_includes body, 'unique_string_2' + assert_not_includes body, 'unique_string_3' + assert_includes body, 'unique_string_4' + assert_includes body, 'unique_string_5' + assert_match /HTTP_AUTHORIZATION\s+: \[FILTERED\]/, body + end + end +end \ No newline at end of file