github-actions[bot]
commented
3 months ago Dependency Review
✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.
OpenSSF Scorecard
| Package | Version | Score | Details |
|---|
Closed NachoEmbrace closed 2 months ago
github-actions[bot]
commented
3 months ago ✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.
| Package | Version | Score | Details |
|---|
github-actions[bot]
commented
3 months ago | Warnings | |
|---|---|
| :warning: | No CHANGELOG entry added. |
| :warning: | **Sources/EmbraceCore/Capture/Network/NetworkPayloadCapture/EncryptedNetworkPayload.swift#L83** - Prefer using UTF-8 encoded strings when converting between `String` and `Data` (`non_optional_string_data_conversion`) |
| :warning: | **Sources/EmbraceCore/Capture/Network/NetworkPayloadCapture/EncryptedNetworkPayload.swift#L94** - Prefer using UTF-8 encoded strings when converting between `String` and `Data` (`non_optional_string_data_conversion`) |
| :warning: | **Tests/EmbraceCoreTests/Capture/Network/NetworkPayloadCapture/EncryptedNetworkPayloadTests.swift#L40** - Prefer using UTF-8 encoded strings when converting between `String` and `Data` (`non_optional_string_data_conversion`) |
| :warning: | **Tests/EmbraceCoreTests/Capture/Network/NetworkPayloadCapture/EncryptedNetworkPayloadTests.swift#L58** - Prefer using UTF-8 encoded strings when converting between `String` and `Data` (`non_optional_string_data_conversion`) |
| :warning: | **Tests/TestSupport/TestConstants.swift#L13** - Prefer using UTF-8 encoded strings when converting between `String` and `Data` (`non_optional_string_data_conversion`) |
Generated by :no_entry_sign: Danger Swift against 3ac2a510c4231887a544c8751c67c83469620b99
codecov[bot]
commented
3 months ago Attention: Patch coverage is 95.66327% with 34 lines in your changes missing coverage. Please review.
Project coverage is 91.68%. Comparing base (
5097a6f) to head (3ac2a51). Report is 3 commits behind head on main.
NachoEmbrace
commented
2 months ago PR LGTM. One observation is that I would document specific parts of the code as we might forget about the inner details of this feature in the future. In particular, related to the encryption mechanisms. For example the expected values & formats on
EncryptedPayloadResult(e.g.ivin hex), the expected format of the public keyRSA.createKey(for publicKey: String), the usage of thehybridkey asmechanism, etc.
Comment added in EncryptedNetworkPayload.
This is a new feature that allows the users of the SDK to create rules through the admin dashboard to capture data from their app's http requests. The SDK receives these rules through the remote configuration and applies them when necessary.
The data is encrypted in the SDK before being converted to OpenTelemetry logs. This implementation uses hybrid encryption to secure the data. For this the users will also need to provide an asymmetrical public key for each rule.
Some details:
Technical details:
URLSessionCaptureService. Didn't make sense to swizzle all theURLSessionstuff in 2 places.NetworkPayloadCaptureRulestruct was added toEmbraceConfigInternalthat is used to decode the remote configuration object.URLSessionTaskCaptureRuleis the actual implementation of the rules that has an underlyingNetworkPayloadCaptureRulefrom the remote config.NetworkPayloadCaptureHandleris the new class that handles all the logic and lives insideURLSessionTaskHandler.EncryptedNetworkPayloadis the struct that handles the format for the encrypted payload that is included in the OTel logs.EncryptedNetworkPayload.aes-256-cbcencryption method provided byCommonCrypto.RSA.PKCS1and the public key provided by the user.