java-topology/defects/openscad-0003/patch/openscad-0003-octoprint-token-log-redact.patch

24 lines
1.1 KiB
Diff

# UNDF: UNDF-2026-000001202
--- a/src/gui/OctoPrint.cc
+++ b/src/gui/OctoPrint.cc
@@ -67,9 +67,9 @@ const QJsonDocument OctoPrint::getJsonData(const QString& endpoint) const
[](QNetworkReply *reply) -> const QJsonDocument {
auto doc = QJsonDocument::fromJson(reply->readAll());
- PRINTDB("Response: %s", QString{doc.toJson()}.toStdString());
+ // Do not log raw response — may contain api_key or sensitive config fields.
+ PRINTDB("Response received for endpoint (body redacted)");
return doc;
});
}
@@ -128,9 +128,12 @@ const QString OctoPrint::requestApiKey() const
[](QNetworkReply *reply) -> QString {
const auto doc = QJsonDocument::fromJson(reply->readAll());
- PRINTDB("Response: %s", QString{doc.toJson()}.toStdString());
const auto obj = doc.object();
const auto token = obj.value("app_token").toString();
+ // Log token presence only — never log credential value.
+ PRINTDB("requestApiKey: app_token %s",
+ token.isEmpty() ? std::string("absent") : std::string("received (redacted)"));
return token;
});
}