Merge pull request #18 from facade/censor-request-body

Add ability to censor request body fields

Author: freekmurze

src/Context/ContextContextDetector.php

@@ -19,6 +19,10 @@ private function runningInConsole(): bool
             return $_ENV['APP_RUNNING_IN_CONSOLE'] === 'true';
         }
 
+        if (isset($_ENV['FLARE_FAKE_WEB_REQUEST'])) {
+            return false;
+        }
+
         return in_array(php_sapi_name(), ['cli', 'phpdb']);
     }
 }

src/Flare.php

@@ -13,6 +13,7 @@
 use Facade\FlareClient\Http\Client;
 use Facade\FlareClient\Middleware\AddGlows;
 use Facade\FlareClient\Middleware\AnonymizeIp;
+use Facade\FlareClient\Middleware\CensorRequestBodyFields;
 use Illuminate\Contracts\Container\Container;
 use Illuminate\Pipeline\Pipeline;
 use Throwable;
@@ -226,11 +227,16 @@ private function applyAdditionalParameters(Report $report)
 
     public function anonymizeIp()
     {
-        $this->registerMiddleware(new AnonymizeIp);
+        $this->registerMiddleware(new AnonymizeIp());
 
         return $this;
     }
 
+    public function censorRequestBodyFields(array $fieldNames)
+    {
+        $this->registerMiddleware(new CensorRequestBodyFields($fieldNames));
+    }
+
     public function createReport(Throwable $throwable): Report
     {
         $report = Report::createForThrowable(

src/Middleware/CensorRequestBodyFields.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace Facade\FlareClient\Middleware;
+
+use Facade\FlareClient\Report;
+
+class CensorRequestBodyFields
+{
+    protected $fieldNames = [];
+
+    public function __construct(array $fieldNames)
+    {
+        $this->fieldNames = $fieldNames;
+    }
+
+    public function handle(Report $report, $next)
+    {
+        $context = $report->allContext();
+
+        foreach ($this->fieldNames as $fieldName) {
+            if (isset($context['request_data']['body'][$fieldName])) {
+                $context['request_data']['body'][$fieldName] = '<CENSORED>';
+            }
+        }
+
+        $report->userProvidedContext($context);
+
+        return $next($report);
+    }
+}

tests/FlareTest.php

@@ -126,6 +126,23 @@ public function it_can_anonymize_the_ip()
         ]);
     }
 
+    /** @test */
+    public function it_can_censor_request_data()
+    {
+        $_ENV['FLARE_FAKE_WEB_REQUEST'] = true;
+        $_POST['user'] = 'john@example.com';
+        $_POST['password'] = 'secret';
+
+        $this->flare->censorRequestBodyFields(['user', 'password']);
+
+        $this->reportException();
+
+        $this->fakeClient->assertLastRequestContains('context.request_data.body', [
+            'user' => '<CENSORED>',
+            'password' => '<CENSORED>',
+        ]);
+    }
+
     /** @test */
     public function it_can_merge_user_provided_context()
     {