fix(security): mark HTTP trace redaction helpers as CodeQL barriers (#329)

Author: adityathebe

http/middlewares/logger.go

@@ -70,7 +70,10 @@ func getLogger(req *http.Request) logger.Logger {
 	return commonsCtx.LoggerFromContext(req.Context())
 }
 
-func headerMap(h http.Header, redactedHeaders ...string) map[string]string {
+// redactedHeaderMap sanitizes sensitive headers before they are logged. The
+// "redacted" name also signals to static analysis (CodeQL's clear-text-logging
+// obfuscator barrier) that its result is safe to log.
+func redactedHeaderMap(h http.Header, redactedHeaders ...string) map[string]string {
 	h = logger.SanitizeHeaders(h, redactedHeaders...)
 	m := make(map[string]string, len(h))
 	for k, v := range h {
@@ -90,7 +93,10 @@ func readBody(body io.ReadCloser) (string, io.ReadCloser) {
 	return string(data), io.NopCloser(bytes.NewReader(data))
 }
 
-func sanitizeBody(body string) any {
+// redactBody strips secrets from a request/response body before logging. The
+// "redact" name marks its result as an obfuscator barrier for CodeQL's
+// clear-text-logging analysis.
+func redactBody(body string) any {
 	var m map[string]any
 	if err := json.Unmarshal([]byte(body), &m); err == nil {
 		return logger.StripSecretsFromMap(m)
@@ -127,7 +133,10 @@ func formParams(req *http.Request) (url.Values, bool) {
 	return values, true
 }
 
-func valueMap(values url.Values) map[string]string {
+// redactedValueMap sanitizes sensitive query/form values before logging. The
+// "redacted" name marks its result as an obfuscator barrier for CodeQL's
+// clear-text-logging analysis.
+func redactedValueMap(values url.Values) map[string]string {
 	m := make(map[string]string, len(values))
 	for key, vals := range values {
 		joined := strings.Join(vals, ",")
@@ -143,7 +152,7 @@ func formatValueBlock(title string, values url.Values) string {
 	if len(values) == 0 {
 		return ""
 	}
-	return fmt.Sprintf("%s:\n%s", title, clicky.Map(valueMap(values)).ANSI())
+	return fmt.Sprintf("%s:\n%s", title, clicky.Map(redactedValueMap(values)).ANSI())
 }
 
 func accessURL(req *http.Request) string {
@@ -234,16 +243,16 @@ func jsonLogger(config TraceConfig, verbose logger.Verbose, rt http.RoundTripper
 	}
 
 	if config.Headers {
-		kv = append(kv, "headers", headerMap(req.Header, config.RedactedHeaders...))
+		kv = append(kv, "headers", redactedHeaderMap(req.Header, config.RedactedHeaders...))
 	}
 	if config.QueryParam && len(req.URL.Query()) > 0 {
-		kv = append(kv, "query", valueMap(req.URL.Query()))
+		kv = append(kv, "query", redactedValueMap(req.URL.Query()))
 	}
 	if len(form) > 0 {
-		kv = append(kv, "form", valueMap(form))
+		kv = append(kv, "form", redactedValueMap(form))
 	}
 	if config.Body && reqBody != "" {
-		kv = append(kv, "body", sanitizeBody(reqBody))
+		kv = append(kv, "body", redactBody(reqBody))
 	}
 
 	if err != nil {
@@ -258,13 +267,13 @@ func jsonLogger(config TraceConfig, verbose logger.Verbose, rt http.RoundTripper
 	kv = append(kv, "status", resp.StatusCode)
 
 	if config.ResponseHeaders {
-		kv = append(kv, "responseHeaders", headerMap(resp.Header, config.RedactedHeaders...))
+		kv = append(kv, "responseHeaders", redactedHeaderMap(resp.Header, config.RedactedHeaders...))
 	}
 	if config.Response && resp.Body != nil {
 		var respBody string
 		respBody, resp.Body = readBody(resp.Body)
 		if respBody != "" {
-			kv = append(kv, "responseBody", sanitizeBody(respBody))
+			kv = append(kv, "responseBody", redactBody(respBody))
 		}
 	}
 
@@ -273,7 +282,7 @@ func jsonLogger(config TraceConfig, verbose logger.Verbose, rt http.RoundTripper
 		// configured trace level wouldn't otherwise capture the response body.
 		if !config.Response {
 			if body := readErrorBody(resp, config.MaxBodyLength); body != "" {
-				kv = append(kv, "responseBody", sanitizeBody(body))
+				kv = append(kv, "responseBody", redactBody(body))
 			}
 		}
 		jsonLogAt(verbose, req, 0, kv, "%s %s %d %s", req.Method, req.URL.Redacted(), resp.StatusCode, elapsed.Truncate(time.Millisecond))