jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-09-21 09:05:10 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

[Client] Redact share secrets from activation URL logs

Browse source
This commit is contained in:
Lukas Brübach 2026-09-19 07:27:05 +02:00
parent 82d71344f1
commit fcaf94553d
1 changed files with 20 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
cockatrice/src/main.cpp
View file

@ -44,6 +44,7 @@
#include <QMessageBox>
#include <QSystemTrayIcon>
#include <QTranslator>
#include <QUrl>
#include <algorithm>
#include <libcockatrice/card/database/card_database_manager.h>
#include <libcockatrice/rng/rng_sfmt.h>
@ -177,6 +178,18 @@ QString const generateClientID()
return strClientID;
}
static QString redactActivationUrl(const QString &url)
{
// Activation URLs carry secrets in their query string (e.g. the deck share
// token); log only the scheme and the action (cockatrice://opendeck), never
// the parameters.
if (!url.startsWith(QStringLiteral("cockatrice://"))) {
return url;
}
const QUrl parsed(url);
return parsed.scheme() + "://" + parsed.host();
}
int main(int argc, char *argv[])
{
#ifdef Q_OS_WIN
@ -273,7 +286,12 @@ int main(int argc, char *argv[])
SingleInstanceManager instance;
if (hasActivationFiles) {
qInfo() << "Activation launch, files:" << startupFiles;
QStringList redactedFiles;
redactedFiles.reserve(startupFiles.size());
for (const QString &file : startupFiles) {
redactedFiles.append(redactActivationUrl(file));
}
qCInfo(MainLog) << "Activation launch, files:" << redactedFiles;
// Activation launch: hand off to the primary instance if one is
// running, otherwise become the primary ourselves. Do this before
// constructing the main window so a hand-off exits cheaply.
@ -346,7 +364,7 @@ int main(int argc, char *argv[])
auto handleActivation = [&ui](const QString &file) {
if (file.startsWith("cockatrice://")) {
qInfo() << "Handling URL activation:" << file;
qCInfo(MainLog) << "Handling URL activation:" << redactActivationUrl(file);
// Route through the window's persistent url parser: it serializes
// link chains so activations handed over while another chain is
// still connecting do not connect concurrently.