Sulkta-OSS/straw
3
0
Fork 0
Code Issues 1 Pull requests 11 Projects Releases Packages Wiki Activity Actions

vc=37 (rust): scrub PII from strawcore info-logs

Browse source 
CVE round-2 HIGH-2: android_logger is configured at info-level in
release builds, so log::info!('strawcore::search query={}', query)
emits the user's actual search query to logcat. LogDump.scrubLine's
regex only catches googlevideo URLs + signed params — bare search
text rides through into a Settings → Export Logs share-sheet
attachment intact. Same for channel_info / stream_info URLs.

Replaced the value-bearing logs with shape-only (query_len /
input_len). The shape is enough to debug 'why did the search
return empty?' without the privacy hit.
This commit is contained in:
Sulkta 2026-05-25 14:11:00 -07:00
parent c960ea934b
commit 27818caf59
3 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
rust/strawcore/src/channel.rs
View file

@ -23,7 +23,7 @@ pub struct ChannelInfo {
#[uniffi::export(async_runtime = "tokio")]
pub async fn channel_info(input: String) -> Result<ChannelInfo, StrawcoreError> {
log::info!("strawcore::channel_info input={}", input);
log::info!("strawcore::channel_info input_len={}", input.len());
let identifier = resolve_channel_identifier(&input)?;
let core = tokio::task::spawn_blocking(move || core_channel_info(identifier))
.await