Skip to content

[PM.24380] fix: Correct and redact flight recorder hostname on logs#6633

Open
aj-rosado wants to merge 4 commits intomainfrom
PM-24380/flight-recorder-redact-hostname
Open

[PM.24380] fix: Correct and redact flight recorder hostname on logs#6633
aj-rosado wants to merge 4 commits intomainfrom
PM-24380/flight-recorder-redact-hostname

Conversation

@aj-rosado
Copy link
Contributor

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-24380

📔 Objective

This aims two address different scenarios.

  1. On the network exception we are logging the cloud api when the user is self-hosted. This is caused because we are looking at the instance without the BaseUrlInterceptor having updated the url. So now we are checking on the NetworkResultCall if we should update the BaseUrl using the existing BaseUrlsProvider
  2. Replace the hostname from self-hosted instance on flight recorder logs in order to protect PII information from the logs.

@aj-rosado aj-rosado requested review from a team and david-livefront as code owners March 10, 2026 12:03
@github-actions github-actions bot added app:password-manager Bitwarden Password Manager app context app:authenticator Bitwarden Authenticator app context labels Mar 10, 2026
@codecov
Copy link

codecov bot commented Mar 10, 2026

Codecov Report

❌ Patch coverage is 71.87500% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.41%. Comparing base (6570115) to head (78b2985).

Files with missing lines Patch % Lines
...in/com/bitwarden/network/core/NetworkResultCall.kt 40.00% 8 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #6633      +/-   ##
==========================================
+ Coverage   85.91%   86.41%   +0.49%     
==========================================
  Files         801      789      -12     
  Lines       57098    56791     -307     
  Branches     8305     8310       +5     
==========================================
+ Hits        49056    49074      +18     
+ Misses       5160     4834     -326     
- Partials     2882     2883       +1     
Flag Coverage Δ
app-data 17.60% <0.00%> (-0.01%) ⬇️
app-ui-auth-tools 20.79% <0.00%> (-0.01%) ⬇️
app-ui-platform 15.05% <0.00%> (-0.01%) ⬇️
app-ui-vault 25.83% <0.00%> (-0.02%) ⬇️
authenticator 6.65% <0.00%> (+0.01%) ⬆️
lib-core-network-bridge 4.32% <71.87%> (+0.05%) ⬆️
lib-data-ui 0.94% <0.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@github-actions
Copy link
Contributor

github-actions bot commented Mar 10, 2026

Logo
Checkmarx One – Scan Summary & Details250ff5da-8396-4128-a329-d3bc166b0c41

Great job! No new security vulnerabilities introduced in this pull request

@aj-rosado aj-rosado changed the title [PM.24380] Correct and redact flight recorder hostname on logs [PM.24380] fix: Correct and redact flight recorder hostname on logs Mar 10, 2026
@aj-rosado aj-rosado added the t:bug Change Type - Bug label Mar 10, 2026
val url = if (actualHost != null) {
"${originalUrl.protocol}://$actualHost${originalUrl.path}"
} else {
"${originalUrl.protocol}://${originalUrl.authority}${originalUrl.path}"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to rebuild here, can't we return originalUrl?

Copy link
Contributor

@SaintPatrck SaintPatrck left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❓ I recently added logging of hostname to CookieIntercepter. Do those need to be checked/redacted also?

throwable?.let {
bw.append(" – ")
bw.append(it.getStackTraceString())
bw.append(it.getStackTraceString().redactUrls()) // Also redact stack traces
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we merge these changes first?
#6616


// Check if this is a hardcoded default URL that will be replaced by BaseUrlInterceptor
// Match against the defaults from RetrofitsImpl.kt line 111 and EnvironmentUrlDataJson
val actualHost = if (baseUrlsProvider != null) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we use a let

// Match against the defaults from RetrofitsImpl.kt line 111 and EnvironmentUrlDataJson
val actualHost = if (baseUrlsProvider != null) {
when (originalUrl.host) {
"api.bitwarden.com" -> baseUrlsProvider.getBaseApiUrl().toHttpUrlOrNull()?.host
Copy link
Collaborator

@david-livefront david-livefront Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can avoid all this complexity with an Interceptor that handles the error logging.

class NetworkErrorLogInterceptor : Interceptor {
    override fun intercept(chain: Interceptor.Chain): Response {
        return chain
            .proceed(chain.request())
            .also {
                if (!it.isSuccessful) {
                    val url = it.request.url.toUrl().run { "$protocol://$authority$path" }
                    Timber.e("Network Error: $url")
                }
            }
    }
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

app:authenticator Bitwarden Authenticator app context app:password-manager Bitwarden Password Manager app context t:bug Change Type - Bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants