Skip to content

[ActionCable] No way to filter out any sensitive data which may be passed as an argument to the remote procedure over ws protocol.. #25088

@Anuragjain89

Description

@Anuragjain89

Steps to reproduce

Just followed the action cable demo from DHH on rails homepage.

You would notice that whenever the RoomChannel#speak is invoked over websocket protocol, the server logs show the arguments which are passed.

RoomChannel#speak({"message"=>"test"})

For HTTP requests, we have filter_parameters to filter out any sensitive data from the logs.
However, for these RPCs, I could not find any way to filter out any sensitive data which may be passed as an argument to the remote procedure.

Expected behavior

I expected some mechanism to filter out logs for any arbitrary arguments which are passed over ws protocol.

Actual behavior

I could not find a way to filter out logs for data transmitted over ws protocol.
Please advise if this behavior is on purpose.

Below is the related code which I am referring to

#actioncable-5.0.0.rc1/lib/action_cable/channel/base.rb
def dispatch_action(action, data)
  # What if we do not want this to be logged.
  logger.info action_signature(action, data)

  if method(action).arity == 1
    public_send action, data
  else
    public_send action
  end
end

def action_signature(action, data)
  "#{self.class.name}##{action}".tap do |signature|
    if (arguments = data.except('action')).any?
      signature << "(#{arguments.inspect})"
    end
  end
end

System configuration

Rails version: 5.0.0.rc1

Ruby version: ruby 2.2.4p230 (2015-12-16 revision 53155) [x86_64-linux]

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions