Open tomas-stefano opened 1 month ago
My PR where I am working on this issue:
https://github.com/DFE-Digital/apply-for-teacher-training/pull/9502
Hi me again.
After reading the internals of the gem I realised that the gem doesn't use our custom log formatter for Action Mailer
I had to do a monkey patch on my application:
## To avoid logging sensitive data on "subjects" and "to":
module RailsSemanticLogger
module ActionMailer
class LogSubscriber < ::ActiveSupport::LogSubscriber
class EventFormatter
def payload
{}.tap do |h|
h[:event_name] = event.name
h[:mailer] = mailer
h[:action] = action
h[:message_id] = event.payload[:message_id]
h[:perform_deliveries] = event.payload[:perform_deliveries]
h[:subject] = '[FILTERED]'
h[:to] = '[FILTERED]'
h[:from] = event.payload[:from]
h[:bcc] = event.payload[:bcc]
h[:cc] = event.payload[:cc]
h[:date] = date
h[:duration] = event.duration.round(2) if log_duration?
h[:args] = '[FILTERED]'
end
end
end
end
end
end
I do wonder if we could replace this formatter as a future feature for the gem?
We implemented on the PR linked above the event formatter using the rails parameter logging. Maybe we can add this to the gem?
Context
I am working on an application where the email subject contains sensitive information, such as usernames. I have implemented a custom log formatter to redact sensitive information from logs. While the custom log formatter works correctly for web application logs, it does not seem to be applied to logs generated by background workers (Sidekiq jobs).
Then the
CustomLogFormatter
definition (I added a puts to check if is called - you can read the code):I can see this custom log working as expected although is does not work for the worker when they finish the job.
I can see the Custom log working for the web app and the logs working:
But on the worker after the mail is delivered / or skipped (even the puts is not even being called and the log leaks sensitive information):
the subject and the to should be redacted and most important, the custom logger (and the puts) also should have being called but apparently it is not.
It the perform deliveries not using tha appenders to call the custom log?
Am I missing something?