search

singer-io / tap-harvest

A Singer tap for extracting data from the Harvest API
GNU Affero General Public License v3.0
8 stars 13 forks source link

don't log plaintext AT url param when logging request #13

Closed bi1yeu closed 6 years ago

bi1yeu commented 6 years ago

This tap logs the request URL, which includes the access_token as a URL parameter. This change replaces each character of the AT with a . to hide it in the logs.

$ tap-harvest -c harvest-config.json > /dev/null
  INFO Refreshing access token
  INFO Got refreshed access token
  INFO Starting sync
  INFO GET https://stitchtest2.harvestapp.com/clients?access_token=......................................................................................
  INFO GET https://stitchtest2.harvestapp.com/contacts?access_token=......................................................................................
  INFO GET https://stitchtest2.harvestapp.com/people?access_token=......................................................................................
  INFO GET https://stitchtest2.harvestapp.com/tasks?access_token=......................................................................................
  INFO GET https://stitchtest2.harvestapp.com/projects?access_token=......................................................................................
  INFO GET https://stitchtest2.harvestapp.com/expense_categories?access_token=......................................................................................
  INFO GET https://stitchtest2.harvestapp.com/expenses?access_token=......................................................................................
  INFO GET https://stitchtest2.harvestapp.com/invoice_item_categories?access_token=......................................................................................
  INFO GET https://stitchtest2.harvestapp.com/invoices?updated_since=2017-04-19+13%3A37&access_token=......................................................................................
  INFO Sync complete