search

MindscapeHQ / raygun4net

Raygun provider for .NET
https://raygun.com
MIT License
126 stars 93 forks source link

Raygun4Net.AspNetCore not handling cookies properly. #414

Closed kevinbuhmann closed 9 months ago

kevinbuhmann commented 5 years ago

  1. The request building sets cookies to null if the request does not have form data. This appears to be a copy/paste mistake unless there's something I'm missing. Is there a reason to check request.HasFormContentType before retrieving cookies? https://github.com/MindscapeHQ/raygun4net/blob/master/Mindscape.Raygun4Net.AspNetCore/Builders/RaygunAspNetCoreRequestMessageBuilder.cs#L82

  2. The Cookie header can leak sensitive cookies if it's not explicitly ignored. I would think the Cookie header should be stripped or at least sanitized if there are ignored cookie names.

phillip-haydon commented 9 months ago

It looks like this was fixed 3 years ago, the check for forms content was removed. For the cookie, there's an exclusion list to remove cookies, this just acts in the same way being able to remove any other sensitive data works for queries/forms/headers etc.