TencentBlueKing / bk-user

蓝鲸用户管理是蓝鲸智云提供的企业组织架构和用户管理解决方案,为企业统一登录提供认证源服务。
MIT License
59 stars 66 forks source link

移除日志中的敏感信息 #1572

Open narasux opened 8 months ago

narasux commented 8 months ago

场景:用户密码 / 密码重置链接通过 邮件 / 短信 发送失败后,会出现在日志中,属于敏感信息,可能有泄露的问题

narasux commented 8 months ago

可以参考:https://github.com/TencentBlueKing/blueking-auth/blob/main/src/bkauth/pkg/logging/desensitize.go

narasux commented 8 months ago

基于 logging.Filter 实现 https://cloud.tencent.com/developer/article/2317410

narasux commented 8 months ago

https://github.com/TencentBlueKing/bk-user/blob/4c64aa8cfe76304ef5771949fc2263bfb5e0bf96/src/bk-user/bkuser/common/log.py#L16

narasux commented 8 months ago