• Z
    Configuration item `config.filter_parameters` could also filter out sensitive... · 180dcd1b
    Zhang Kang 提交于
    Configuration item `config.filter_parameters` could also filter out sensitive value of database column when call `#inspect`
    
    * Why
    Some sensitive data will be exposed in log accidentally by calling `#inspect`, e.g.
    
    ```ruby
    @account = Account.find params[:id]
    payload = { account: @account }
    logger.info "payload will be #{ payload }"
    ```
    
    All the information of `@account` will be exposed in log.
    
    * Solution
    Add a class attribute filter_attributes to specify which values of columns shouldn't be exposed.
    This attribute equals to `Rails.application.config.filter_parameters` by default.
    
    ```ruby
    Rails.application.config.filter_parameters += [:credit_card_number]
    Account.last.insepct # => #<Account id: 123, credit_card_number: [FILTERED] ...>
    ```
    180dcd1b
core.rb 20.0 KB