Skip to content

Commit

Permalink
Fix over-eager PII filtering (#627)
Browse files Browse the repository at this point in the history
In a25800b, we changed the way
redaction works for PII filtering. The change did not account for
detail log lines, leading to all log lines always being redacted.

Update the redaction mechanism to check for a parent log line.
  • Loading branch information
msakrejda authored Nov 13, 2024
1 parent 903fc2c commit 0840691
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 2 deletions.
3 changes: 2 additions & 1 deletion logs/replace.go
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import (
"slices"
"sort"

"github.com/google/uuid"
"github.com/pganalyze/collector/state"
)

Expand All @@ -17,7 +18,7 @@ func ReplaceSecrets(logLines []state.LogLine, filterLogSecret []state.LogSecretK
}
}
for idx, logLine := range logLines {
if filterUnidentified && logLines[idx].Classification == 0 {
if filterUnidentified && logLines[idx].Classification == 0 && logLines[idx].ParentUUID == uuid.Nil {
logLines[idx].Content = replacement + "\n"
} else {
sort.Slice(logLine.SecretMarkers, func(i, j int) bool {
Expand Down
2 changes: 1 addition & 1 deletion logs/replace_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ var replaceTests = []replaceTestpair{
{
filterLogSecret: "statement_text, statement_parameter, unidentified",
input: "2018-03-11 20:00:02 UTC:1.1.1.1(2):a@b:[3]:LOG: duration: 4079.697 ms execute <unnamed>: \nSELECT * FROM x WHERE y = $1 LIMIT $2\n2018-03-11 20:00:02 UTC:1.1.1.1(2):a@b:[3]:DETAIL: parameters: $1 = 'long string', $2 = '1'\n",
output: "duration: 4079.697 ms execute <unnamed>: \n[redacted]\n[redacted]\n",
output: "duration: 4079.697 ms execute <unnamed>: \n[redacted]\nparameters: $1 = '[redacted]', $2 = '[redacted]'\n",
},
}

Expand Down

0 comments on commit 0840691

Please sign in to comment.