Closed moisesvega closed 8 months ago
Attention: Patch coverage is 76.27119%
with 28 lines
in your changes are missing coverage. Please review.
Project coverage is 69.03%. Comparing base (
12ffd74
) to head (6296da8
).
Files | Patch % | Lines |
---|---|---|
gen/internal/tests/exceptions/exceptions.go | 64.10% | 7 Missing and 7 partials :warning: |
gen/internal/tests/structs/structs.go | 64.10% | 7 Missing and 7 partials :warning: |
:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.
Currently, there's no feature to exclude sensitive information from outputs generated by the Stringer and Error interface implementations. However, we use the nolog annotation to exclude specific properties from being logged by the zap.objectMarshal method. This is particularly useful for omitting sensitive data in zap logger outputs. Despite this, there are scenarios where sensitive information might still be exposed. For instance, consider the following example:
The code snippet above leads to the following implementation for the MarshalLogObject method:
However, our implementation of the Stringer and Error interfaces inadvertently exposes properties marked with nolog:
This behavior can lead to unintended exposure of information annotated as
nolog
. For example, when this exception is utilized as an Error, or when logged usingzap.Stringer("exception", e)
orzap.Error(e)
, the nolog-annotated property is inadvertently revealed:playground link
This PR introduces a new feature that enables the redaction of specified properties through a new Go annotation, go.redacted. When applied, this annotation ensures that the actual value of a property is replaced with in the outputs generated by our Stringer and Error interface implementations.
Output after this diff: