Merge pull request #379 from Kuadrant/360-logs-show-plaintext-redis-p…

…assword-when-theres-connection-errors

logs with redacted password in URL

limitador-server/sandbox/.gitignore

@@ -3,4 +3,5 @@
 *.key
 *.pem
 *.csr
-report.html
+*.srl
+report.html

limitador-server/src/config.rs

@@ -15,7 +15,27 @@
 
 use crate::envoy_rls::server::RateLimitHeaders;
 use limitador::storage;
+use std::fmt;
 use tracing::level_filters::LevelFilter;
+use url::Url;
+
+pub fn redacted_url(url: String) -> String {
+    return match Url::parse(url.as_str()) {
+        Ok(url_object) => {
+            if url_object.password().is_some() {
+                let mut owned_url = url_object.clone();
+                if owned_url.set_password(Some("****")).is_ok() {
+                    String::from(owned_url)
+                } else {
+                    url.clone()
+                }
+            } else {
+                url.clone()
+            }
+        }
+        Err(_) => url.clone(),
+    };
+}
 
 #[derive(Debug)]
 pub struct Configuration {
@@ -164,12 +184,24 @@ pub struct DiskStorageConfiguration {
     pub optimization: storage::disk::OptimizeFor,
 }
 
-#[derive(PartialEq, Eq, Debug)]
+#[derive(PartialEq, Eq)]
 pub struct RedisStorageConfiguration {
     pub url: String,
     pub cache: Option<RedisStorageCacheConfiguration>,
 }
 
+impl fmt::Debug for RedisStorageConfiguration {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Foo")
+            .field("cache", &self.cache)
+            .field(
+                "url",
+                &format_args!("{}", redacted_url(self.url.clone()).as_str()),
+            )
+            .finish()
+    }
+}
+
 #[derive(PartialEq, Eq, Debug)]
 pub struct RedisStorageCacheConfiguration {
     pub batch_size: usize,

limitador-server/src/main.rs

@@ -8,7 +8,7 @@ extern crate clap;
 #[cfg(feature = "distributed_storage")]
 use crate::config::DistributedStorageConfiguration;
 use crate::config::{
-    Configuration, DiskStorageConfiguration, InMemoryStorageConfiguration,
+    redacted_url, Configuration, DiskStorageConfiguration, InMemoryStorageConfiguration,
     RedisStorageCacheConfiguration, RedisStorageConfiguration, StorageConfiguration,
 };
 use crate::envoy_rls::server::{run_envoy_rls_server, RateLimitHeaders};
@@ -121,7 +121,8 @@ impl Limiter {
         AsyncRedisStorage::new(redis_url)
             .await
             .unwrap_or_else(|err| {
-                eprintln!("Failed to connect to Redis at {redis_url}: {err}");
+                let redacted_redis_url = redacted_url(String::from(redis_url));
+                eprintln!("Failed to connect to Redis at {redacted_redis_url}: {err}");
                 process::exit(1)
             })
     }
@@ -139,7 +140,8 @@ impl Limiter {
             .response_timeout(Duration::from_millis(cache_cfg.response_timeout));
 
         cached_redis_storage.build().await.unwrap_or_else(|err| {
-            eprintln!("Failed to connect to Redis at {redis_url}: {err}");
+            let redacted_redis_url = redacted_url(String::from(redis_url));
+            eprintln!("Failed to connect to Redis at {redacted_redis_url}: {err}");
             process::exit(1)
         })
     }