Add flag MaskSensitiveInfo

to allow for explicit caller controlled redaction of
Authentication credentials in generated outputs.

Author: yadij

src/HttpHeader.cc

@@ -669,16 +669,15 @@ HttpHeader::parse(const char *header_start, size_t hdrLen, Http::ContentLengthIn
 
 /* packs all the entries using supplied packer */
 void
-HttpHeader::packInto(Packable * p, bool mask_sensitive_info) const
+HttpHeader::packInto(Packable * p, MaskSensitiveInfo masking) const
 {
     HttpHeaderPos pos = HttpHeaderInitPos;
     const HttpHeaderEntry *e;
     assert(p);
-    debugs(55, 7, this << " into " << p <<
-           (mask_sensitive_info ? " while masking" : ""));
+    debugs(55, 7, this << " into " << p << (masking == MaskSensitiveInfo::on ? " while masking" : ""));
     /* pack all entries one by one */
     while ((e = getEntry(&pos))) {
-        if (!mask_sensitive_info) {
+        if (masking == MaskSensitiveInfo::off) {
             e->packInto(p);
             continue;
         }

src/HttpHeader.h

@@ -11,11 +11,13 @@
 
 #include "anyp/ProtocolVersion.h"
 #include "base/LookupTable.h"
+#include "base/MaskSensitiveInfo.h"
 #include "http/RegisteredHeaders.h"
 /* because we pass a spec by value */
 #include "HttpHeaderMask.h"
 #include "mem/PoolingAllocator.h"
 #include "sbuf/forward.h"
+#include "security/forward.h"
 #include "SquidString.h"
 
 #include <vector>
@@ -96,7 +98,9 @@ class HttpHeader
     /// \returns 0 when needs more data
     /// \returns -1 on error
     int parse(const char *buf, size_t buf_len, bool atEnd, size_t &hdr_sz, Http::ContentLengthInterpreter &interpreter);
-    void packInto(Packable * p, bool mask_sensitive_info=false) const;
+    /// Serialize HTTP Fields using HTTP/1.1 syntax in RFC 9112 section 5.
+    /// Optionally redact credentials in HTTP Authentication headers.
+    void packInto(Packable *, MaskSensitiveInfo) const;
     HttpHeaderEntry *getEntry(HttpHeaderPos * pos) const;
     HttpHeaderEntry *findEntry(Http::HdrType id) const;
     /// deletes all fields with a given name, if any.

src/HttpReply.cc

@@ -87,7 +87,7 @@ void
 HttpReply::packHeadersUsingFastPacker(Packable &p) const
 {
     sline.packInto(&p);
-    header.packInto(&p);
+    header.packInto(&p, MaskSensitiveInfo::off);
     p.append("\r\n", 2);
 }
 

src/HttpRequest.cc

@@ -334,19 +334,19 @@ HttpRequest::swapOut(StoreEntry * e)
 {
     assert(e);
     e->buffer();
-    pack(e);
+    pack(e, MaskSensitiveInfo::off);
     e->flush();
 }
 
 /* packs request-line and headers, appends <crlf> terminator */
 void
-HttpRequest::pack(Packable * const p, const bool maskSensitiveInfo) const
+HttpRequest::pack(Packable * const p, MaskSensitiveInfo mask) const
 {
     assert(p);
     /* pack request-line */
     packFirstLineInto(p, false /* origin-form */);
     /* headers */
-    header.packInto(p, maskSensitiveInfo);
+    header.packInto(p, mask);
     /* indicate the end of the header section */
     p->append("\r\n", 2);
 }
@@ -358,7 +358,7 @@ void
 httpRequestPack(void *obj, Packable *p)
 {
     HttpRequest *request = static_cast<HttpRequest*>(obj);
-    request->pack(p);
+    request->pack(p, MaskSensitiveInfo::off);
 }
 
 /* returns the length of request line + headers + crlf */

src/HttpRequest.h

@@ -204,7 +204,9 @@ class HttpRequest: public Http::Message
 
     void swapOut(StoreEntry * e);
 
-    void pack(Packable * p, bool maskSensitiveInfo = false) const;
+    /// Serialize HTTP Request using HTTP/1.1 origin-form syntax in RFC 9112 section 3.
+    /// \copydoc HttpHeader::packInto()
+    void pack(Packable * const, MaskSensitiveInfo) const;
 
     static void httpRequestPack(void *obj, Packable *p);
 

src/base/Makefile.am

@@ -48,6 +48,7 @@ libbase_la_SOURCES = \
 	JobWait.h \
 	Lock.h \
 	LookupTable.h \
+	MaskSensitiveInfo.h \
 	OnOff.h \
 	Packable.h \
 	PackableStream.h \

src/base/MaskSensitiveInfo.h

@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) 1996-2025 The Squid Software Foundation and contributors
+ *
+ * Squid software is distributed under GPLv2+ license and includes
+ * contributions from numerous individuals and organizations.
+ * Please see the COPYING and CONTRIBUTORS files for details.
+ */
+
+#ifndef SQUID_SRC_BASE_MASKSENSITIVEINFO_H
+#define SQUID_SRC_BASE_MASKSENSITIVEINFO_H
+
+#include "base/OnOff.h"
+
+/// Flags for explicit decisions on handling of sensitive information.
+using MaskSensitiveInfo = OnOff;
+
+#endif /* SQUID_SRC_BASE_MASKSENSITIVEINFO_H */

src/client_side.cc

@@ -327,22 +327,22 @@ prepareLogWithRequestDetails(HttpRequest *request, const AccessLogEntryPointer &
     if (Config.onoff.log_mime_hdrs) {
         MemBuf mb;
         mb.init();
-        request->header.packInto(&mb);
+        request->header.packInto(&mb, MaskSensitiveInfo::off);
         //This is the request after adaptation or redirection
         aLogEntry->headers.adapted_request = xstrdup(mb.buf);
 
         // the virgin request is saved to aLogEntry->request
         if (aLogEntry->request) {
             mb.reset();
-            aLogEntry->request->header.packInto(&mb);
+            aLogEntry->request->header.packInto(&mb, MaskSensitiveInfo::off);
             aLogEntry->headers.request = xstrdup(mb.buf);
         }
 
 #if USE_ADAPTATION
         const Adaptation::History::Pointer ah = request->adaptLogHistory();
         if (ah != nullptr) {
             mb.reset();
-            ah->lastMeta.packInto(&mb);
+            ah->lastMeta.packInto(&mb, MaskSensitiveInfo::off);
             aLogEntry->adapt.last_meta = xstrdup(mb.buf);
         }
 #endif
@@ -724,7 +724,7 @@ clientPackRangeHdr(const HttpReplyPointer &rep, const HttpHdrRangeSpec * spec, S
 
     httpHeaderAddContRange(&hdr, *spec, rep->content_length);
 
-    hdr.packInto(mb);
+    hdr.packInto(mb, MaskSensitiveInfo::off);
     hdr.clean();
 
     /* append <crlf> (we packed a header, not a reply) */

src/client_side_reply.cc

@@ -1004,7 +1004,7 @@ clientReplyContext::traceReply()
     http->storeEntry()->buffer();
     MemBuf content;
     content.init();
-    http->request->pack(&content, true /* hide authorization data */);
+    http->request->pack(&content, MaskSensitiveInfo::on);
     const HttpReplyPointer rep(new HttpReply);
     rep->setHeaders(Http::scOkay, nullptr, "message/http", content.contentSize(), 0, squid_curtime);
     rep->body.set(SBuf(content.buf, content.size));

src/clients/HttpTunneler.cc

@@ -152,7 +152,7 @@ Http::Tunneler::writeRequest()
                                               &hdr_out,
                                               connection->getPeer(),
                                               flags);
-        hdr_out.packInto(&mb);
+        hdr_out.packInto(&mb, MaskSensitiveInfo::off);
         hdr_out.clean();
         mb.append("\r\n", 2);