[dandonarahul2002]

JIRA: https://browserstack.atlassian.net/browse/INTG-3246

data.request.params logs the raw query string. OAuth tokens, API keys and signed-URL signatures passed as query parameters therefore reach the logs in clear text. DATA-12974 redacts headers but doesn't cover these.

Changes

• Query parameter redaction: these parameters are logged as [REDACTED], keeping the name: access_token, refresh_token, id_token, token, api_key, apikey, api_token, private_token, client_secret, secret, password, signature, X-Amz-Signature, X-Amz-Credential, X-Amz-Security-Token.
  • Matched case-insensitively after URL decoding.
  • Hosts can add names with Chitragupta.extendSensitiveParams([...]), which mirrors extendSensitiveHeaders.
  • A params object a host supplies through meta.data.request.params is redacted the same way.
• originalUrl: endpoint and params now come from request.originalUrl when present, falling back to request.url. Express rewrites url relative to the router mount point, so sub-router routes logged a partial path.
  • integrations-service has carried this one-line change on a fork branch (INTG-NOJIRA-endpoint-fix, d90fbb8, 2024). That's why it's still pinned to a commit without the DATA-12974 header redaction.
  • With this upstreamed, integrations-service moves back to master and gets header redaction too.
• Docs and tests: README items 5–6, and test/params.js added to npm test.

Compatibility

• Only the logged values of the listed parameters change. Parameter names, endpoint and the record shape stay the same.
• Services that already pass originalUrl through Express will log the full mounted path in endpoint where they previously logged the sub-router path.

Testing

test/params.js covers redaction, encoded names, parameters without values, host-supplied params objects, the extend API, and the originalUrl fallback. This repo's CI doesn't run npm test (its workflows are npm audit and Semgrep), so please run npm test locally while reviewing.

Follow-up (integrations-service)

After this merges, bump the chitragupta pin to the merge commit and call Chitragupta.extendSensitiveHeaders(['x-api-admin-key']) and extendSensitiveParams(['code']) at startup.

Related: browserstack/integrations-service#3759, #3760, #3761

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited), Workspace UI (inherited); Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: 03f29361-269a-44f5-a7c3-8f31bf1c9ce3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}