Skip to content

Commit 3d2dca7

Browse files
Naorayclaude
andauthored
Strip empty flash data and token from session (#42)
* fix(tracing): strip empty flash data and token from session Closes #35 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: use Arr::except instead of collection for session data filtering Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 parent ca4507b commit 3d2dca7

File tree

2 files changed

+55
-7
lines changed

2 files changed

+55
-7
lines changed

src/Tracing/SessionCollector.php

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
namespace Naoray\LaravelGithubMonolog\Tracing;
44

5+
use Illuminate\Support\Arr;
56
use Illuminate\Support\Facades\Context;
67
use Illuminate\Support\Facades\Session;
78
use Naoray\LaravelGithubMonolog\Tracing\Concerns\RedactsData;
@@ -27,12 +28,21 @@ public function collect(): void
2728
return;
2829
}
2930

30-
Context::addHidden('session', [
31-
'data' => $this->redactPayload(Session::all()),
32-
'flash' => [
33-
'old' => Session::get('_flash.old', []),
34-
'new' => Session::get('_flash.new', []),
35-
],
36-
]);
31+
$data = Arr::except(Session::all(), ['_token', '_flash']);
32+
33+
$session = [
34+
'data' => $this->redactPayload($data),
35+
];
36+
37+
$flash = [
38+
'old' => Session::get('_flash.old', []),
39+
'new' => Session::get('_flash.new', []),
40+
];
41+
42+
if (! empty($flash['old']) || ! empty($flash['new'])) {
43+
$session['flash'] = $flash;
44+
}
45+
46+
Context::addHidden('session', $session);
3747
}
3848
}

tests/Tracing/SessionCollectorTest.php

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,41 @@
3232

3333
expect(Context::hasHidden('session'))->toBeFalse();
3434
});
35+
36+
it('strips empty flash data from session', function () {
37+
Session::start();
38+
Session::put('key', 'value');
39+
40+
$this->collector->collect();
41+
42+
$session = Context::getHidden('session');
43+
44+
expect($session)->not->toHaveKey('flash');
45+
expect($session['data'])->not->toHaveKey('_flash');
46+
});
47+
48+
it('preserves non-empty flash data', function () {
49+
Session::start();
50+
Session::put('key', 'value');
51+
Session::flash('message', 'Hello World');
52+
53+
$this->collector->collect();
54+
55+
$session = Context::getHidden('session');
56+
57+
expect($session)->toHaveKey('flash');
58+
expect($session['flash']['new'])->toContain('message');
59+
});
60+
61+
it('strips _token from session data', function () {
62+
Session::start();
63+
Session::put('key', 'value');
64+
Session::put('_token', 'csrf-token-value');
65+
66+
$this->collector->collect();
67+
68+
$session = Context::getHidden('session');
69+
70+
expect($session['data'])->not->toHaveKey('_token');
71+
expect($session['data']['key'])->toBe('value');
72+
});

0 commit comments

Comments
 (0)