-
-
Notifications
You must be signed in to change notification settings - Fork 220
Description
Version: 2.11.0
Bug Description
Tracy documentation has a section about using Nette Framework configuration.
It says that setting tracy.keysToHide will hide (sanitize) the values of the keys specified when a variable is dumped using dump(). To me it seems that's not the case, and that tracy.keysToHide is only used for the (red) bluescreen, and not for dump() or bdump():
tracy/src/Bridges/Nette/TracyExtension.php
Line 108 in 7543389
| 'keysToHide' => 'array_push(Tracy\Debugger::getBlueScreen()->keysToHide, ... ?)', |
Steps To Reproduce
Use the following config:
tracy:
keysToHide: [password, pass, foobar]Then ad the following somewhere in the project:
dump(['password' => 'foo']);
bdump(['password' => 'foo']);The array dumped to both the screen and the Tracy bar will have the password not hidden.
Expected Behavior
I'd expect the password to be hidden, especially when the documentation says so.
Possible Solution
I'm not sure, but the following works for me, as a proof of concept. Instead of setting keysToHide on the bluescreen object only, I set it on both.
Replace this:
tracy/src/Bridges/Nette/TracyExtension.php
Lines 107 to 109 in 7543389
| $tbl = [ | |
| 'keysToHide' => 'array_push(Tracy\Debugger::getBlueScreen()->keysToHide, ... ?)', | |
| 'fromEmail' => 'if ($logger instanceof Tracy\Logger) $logger->fromEmail = ?', |
with the following code:
if ($key === 'keysToHide') {
$initialize->addBody($builder->formatPhp('Tracy\Debugger::$keysToHide = ?;', Nette\DI\Helpers::filterArguments([$value])));
$initialize->addBody($builder->formatPhp('array_push(Tracy\Debugger::getBlueScreen()->keysToHide, ... ?);', Nette\DI\Helpers::filterArguments([$value])));
continue;
}
$tbl = [
'fromEmail' => 'if ($logger instanceof Tracy\Logger) $logger->fromEmail = ?',There's probably a better way but if there isn't, I'll happily prepare a pull request (done #609)