mirror of https://github.com/pelias/api.git
Diana Shkolnikov
8 years ago
12 changed files with 271 additions and 15 deletions
@ -0,0 +1,24 @@
|
||||
var fieldsToRemove = ['text', 'focus.point.lat', 'focus.point.lon', |
||||
'boundary.circle.lat', 'boundary.circle.lon', 'point.lat', 'point.lon']; |
||||
|
||||
function isDNT(req) { |
||||
if (!req.headers) { |
||||
return false; |
||||
} |
||||
return req.headers.DNT || req.headers.dnt || req.headers.do_not_track; |
||||
} |
||||
|
||||
function removeFields(query) { |
||||
fieldsToRemove.forEach(function(field) { |
||||
if (query[field]) { |
||||
query[field] = '[removed]'; |
||||
} |
||||
}); |
||||
|
||||
return query; |
||||
} |
||||
|
||||
module.exports = { |
||||
isDNT: isDNT, |
||||
removeFields: removeFields |
||||
}; |
||||
@ -0,0 +1,96 @@
|
||||
var logging = require('../../../helper/logging'); |
||||
|
||||
module.exports.tests = {}; |
||||
|
||||
module.exports.tests.dnt = function(test) { |
||||
test('DNT=1 triggers DNT detection', function(t) { |
||||
var req = { |
||||
headers: { |
||||
DNT: '1' |
||||
} |
||||
}; |
||||
|
||||
t.ok(logging.isDNT(req), 'DNT detected'); |
||||
t.end(); |
||||
}); |
||||
|
||||
test('DNT=0 triggers DNT detection', function(t) { |
||||
// because this is common apparently, although the spec says to do the opposite
|
||||
// see https://en.wikipedia.org/wiki/Do_Not_Track
|
||||
var req = { |
||||
headers: { |
||||
DNT: '0' |
||||
} |
||||
}; |
||||
|
||||
t.ok(logging.isDNT(req), 'DNT detected'); |
||||
t.end(); |
||||
}); |
||||
|
||||
test('do_not_track header triggers DNT detection', function(t) { |
||||
// according to @riordan, some people use this too
|
||||
var req = { |
||||
headers: { |
||||
do_not_track: '1' |
||||
} |
||||
}; |
||||
|
||||
t.ok(logging.isDNT(req), 'DNT detected'); |
||||
t.end(); |
||||
}); |
||||
|
||||
test('no DNT or do_not_track header does not trigger DNT detection', function(t) { |
||||
var req = { |
||||
headers: { |
||||
'Accept-Charset': 'utf-8' |
||||
} |
||||
}; |
||||
|
||||
t.notOk(logging.isDNT(req), 'DNT detected'); |
||||
t.end(); |
||||
}); |
||||
}; |
||||
|
||||
module.exports.tests.field_removal = function(test) { |
||||
test('removes multiple fields that may have sensitive information', function(t) { |
||||
var query = { |
||||
text: 'possibly sensitive text', |
||||
'point.lat': 'possibly sensitive location info' |
||||
}; |
||||
|
||||
var cleaned_query = logging.removeFields(query); |
||||
|
||||
var expected = { |
||||
text: '[removed]', |
||||
'point.lat': '[removed]' |
||||
}; |
||||
|
||||
t.deepEquals(cleaned_query, expected, 'multiple sensitive fields removed'); |
||||
t.end(); |
||||
}); |
||||
|
||||
test('non-sensitive fields untouched', function(t) { |
||||
var query = { |
||||
sources: 'wof,gn' |
||||
}; |
||||
|
||||
var cleaned_query = logging.removeFields(query); |
||||
|
||||
var expected = { |
||||
sources: 'wof,gn' |
||||
}; |
||||
|
||||
t.deepEquals(cleaned_query, expected, 'non-sensitive fields are not touched'); |
||||
t.end(); |
||||
}); |
||||
}; |
||||
|
||||
module.exports.all = function (tape, common) { |
||||
function test(name, testFunction) { |
||||
return tape('logging: ' + name, testFunction); |
||||
} |
||||
|
||||
for( var testCase in module.exports.tests ){ |
||||
module.exports.tests[testCase](test, common); |
||||
} |
||||
}; |
||||
@ -0,0 +1,83 @@
|
||||
var access_log = require('../../../middleware/access_log'); |
||||
|
||||
module.exports.tests = {}; |
||||
|
||||
module.exports.tests.customRemoteAddress = function(test) { |
||||
test('non-DNT request shows IP in logs', function(t) { |
||||
var req = { |
||||
ip: '8.8.8.8', |
||||
query: '/v1/search?....' |
||||
}; |
||||
|
||||
var result = access_log.customRemoteAddr(req, {}); |
||||
|
||||
t.equals(result, '8.8.8.8', 'IP would be sent to logs'); |
||||
t.end(); |
||||
}); |
||||
|
||||
test('DNT request does not show IP in logs', function(t) { |
||||
var req = { |
||||
ip: '8.8.8.8', |
||||
query: '/v1/search?....', |
||||
headers: { |
||||
DNT: 1 |
||||
} |
||||
}; |
||||
|
||||
var result = access_log.customRemoteAddr(req, {}); |
||||
|
||||
t.equals(result, '[IP removed]', 'IP removed from logs'); |
||||
t.end(); |
||||
}); |
||||
}; |
||||
|
||||
module.exports.tests.customURL = function(test) { |
||||
test('non-DNT request shows full query in logs', function(t) { |
||||
var req = { |
||||
ip: '8.8.8.8', |
||||
query: { |
||||
text: 'london' |
||||
}, |
||||
_parsedUrl: { |
||||
pathname: '/v1/search', |
||||
path: '/v1/search?text=london' |
||||
} |
||||
}; |
||||
|
||||
var result = access_log.customURL(req, {}); |
||||
|
||||
t.equals(result, '/v1/search?text=london', 'query not removed from logs'); |
||||
t.end(); |
||||
}); |
||||
|
||||
test('DNT request removes sensitive fields from logs', function(t) { |
||||
var req = { |
||||
ip: '8.8.8.8', |
||||
query: { |
||||
text: 'london' |
||||
}, |
||||
_parsedUrl: { |
||||
pathname: '/v1/search', |
||||
path: '/v1/search?text=london' |
||||
}, |
||||
headers: { |
||||
DNT: 1 |
||||
} |
||||
}; |
||||
|
||||
var result = access_log.customURL(req, {}); |
||||
|
||||
t.equals(result, '/v1/search?text=%5Bremoved%5D', 'query has sensitive fields removed'); |
||||
t.end(); |
||||
}); |
||||
}; |
||||
|
||||
module.exports.all = function (tape, common) { |
||||
function test(name, testFunction) { |
||||
return tape('[middleware] access_log: ' + name, testFunction); |
||||
} |
||||
|
||||
for( var testCase in module.exports.tests ){ |
||||
module.exports.tests[testCase](test, common); |
||||
} |
||||
}; |
||||
Loading…
Reference in new issue