Parameter Filter not working

I'm using Rails 3.0.3 too.

In the response you posted, the password is not filtered in some places but in others it's not.
The password you used is 'welcome'.
Check "rack.request.form_hash".
I am also seeing it without being filtered on "action_dispatch.request.request_parameters" that you omitted.

I investigated a bit and this is what I found.

The output looks like this https://gist.github.com/930236

Look at #8 Fixture caching does not work with prefixed/suffixed tables the key is (action_dispatch.request.parameters)
and the password is filtered at line #16 Sqlite adapter doesn't handle quoted table names properly

Now look at line #33 AssociationsPreload casts foreign keys to integers the key is same (action_dispatch.request.parameters) . Notice that password is not filtered at line #41 ActiveRecord::Base#has_errors?.

Question is why?

The second key (action_dispatch.request.parameters) has a parent key named (action_dispatch.remote_ip) line #28 ActionView class method to set default order for date and time field helpers.

When rails gets the key and value for this case it looks like this.
key: action_dispatch.remote_ip

value : [something] . However notice that the class of this value is not Hash. In this case value.is_a?(Hash) return false since the class of value is ActionDispatch::RemoteIp::RemoteIpGetter.

The filtering code looks like this

              if regexps.find { |r| key =~ r }                value = '[FILTERED]'
              elsif value.is_a?(Hash)
                value = filter(value)
              elsif value.is_a?(Array)
                value = value.map { |v| v.is_a?(Hash) ? filter(v) : v }
              else ..

Notice that in this case value does not satisfy any of the above cases and hence the value is left as it is and the password value is exposed.

What's the fix?

I don't have a good solution. It is not practically possible to look inside all different kinds of objects and replace the value. I can think of a solution where the values are not printed for the classes like the one mentioned above in normal mode. If you are debugging something then in the debug mode full value should be printed.

I don't know much about the context of the filter code you posted, but I'm assuming it logs the ActionDispatch::RemoteIp::RemoteIpGetter by calling to_s on it. Could something like this work?

elsif value.respond_to?(:to_s)
  value = value.to_s.gsub!(/(#{key}:\s*)([^\s,$]+)/, "#{$1}#{filter($2)}")

@steve

to_s is currently not being called on ActionDispatch::RemoteIp::RemoteIpGetter. Rather the value is left intact. In other words value is not being altered at all.

Secondly after invoking to_s it is hard to be precise about key and value and each class can have its own implementation of to_s.

@neeraj, I think you misunderstood. I was referring to when ActionDispatch::RemoteIp::RemoteIpGetter is actually getting output (i.e. with print or puts or whatever), at which time the to_s is called on it.

But yes, the code you had excerpted was from within the ActionDispatch::Http::ParameterFilter class, which happens before the to_s method ever gets called, so that wouldn't be solvable from here. I would imagine a fix for this issue would have to go straight in the filtered_env method itself.

Oh, and concerning the difficulty in being precise about key/value for each class's own to_s method, yes I agree, but when it comes to filtering sensitive info, something is better than nothing.