logoalt Hacker News

jacobrussellyesterday at 8:10 PM2 repliesview on HN

From what I can tell Symfony wraps these errors in a styled error block so it messes with GitHub's masking. For example, newlines breaking up the token are apparently enough to trick the masker since it's not a substring anymore.

For your example:

Line 34: <red>ghs_fdsafdsarewqfdsa...</red>

Is probably long enough in most cases to break to a new line.

Also, those blocks get "interleaved" like this:

<red>ghs_fdsafdsarewqfdsafdsa</red>

<red>fdsardsardsafdsafs......</red>

So there are now </red>'s within the token, also breaking the substring matching.

This is kind of eye-opening for me -- I have never thought about how styled output like this could cause logging leakages.


Replies

ammar2yesterday at 8:16 PM

Aah, the newlines were the thing I was missing. That makes sense then.