synapse/changelog.d/13855.bugfix at 6b4593a80fa2fd9ec8e1ec82fad74f3b7fbb9ba3 - mirrors/synapse - Sadium Git

mirrors/synapse

mirror of https://github.com/element-hq/synapse.git synced 2024-11-26 11:36:03 +03:00

Eric Eastwood db868db594

Fix access token leak to logs from proxyagent (#13855 )

This can happen specifically with an application service `/transactions/10722?access_token=leaked` request

Fix https://github.com/matrix-org/synapse/issues/13010

---

Saw an example leak in https://github.com/matrix-org/synapse/issues/13423#issuecomment-1205348482

```
2022-08-04 14:47:57,925 - synapse.http.client - 401 - DEBUG - as-sender-signal-1 - Sending request PUT http://localhost:29328/transactions/10722?access_token=<redacted>
2022-08-04 14:47:57,926 - synapse.http.proxyagent - 223 - DEBUG - as-sender-signal-1 - Requesting b'http://localhost:29328/transactions/10722?access_token=leaked' via <HostnameEndpoint localhost:29328>
```

2022-09-23 11:49:39 -05:00

1 line

48 B

Text

Raw Blame History

Fix access token leak to logs from proxy agent.