Railsのログ出力をフィルタする config.filter_parameters の仕組み

# Be sure to restart your server when you modify this file.

# Configure parameters to be filtered from the log file. Use this to limit dissemination of
# sensitive information. See the ActiveSupport::ParameterFilter documentation for supported
# notations and behaviors.
Rails.application.config.filter_parameters += [
  :passw, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn
]

# Be sure to restart your server when you modify this file.

# Configure parameters to be filtered from the log file. Use this to limit dissemination of
# sensitive information. See the ActiveSupport::ParameterFilter documentation for supported
# notations and behaviors.
Rails.application.config.filter_parameters += [
  :passw, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn
]

# https://github.com/rails/rails/blob/v7.0.5/actionpack/lib/action_dispatch/http/filter_parameters.rb
module ActionDispatch
  module Http
    module FilterParameters
      ENV_MATCH = [/RAW_POST_DATA/, "rack.request.form_vars"] # :nodoc:
      NULL_PARAM_FILTER = ActiveSupport::ParameterFilter.new # :nodoc:
      NULL_ENV_FILTER   = ActiveSupport::ParameterFilter.new ENV_MATCH # :nodoc:

       ...

      # Returns a hash of parameters with all sensitive data replaced.
      def filtered_parameters
        # 注釈: parametersにはリクエストパラメータが入っている
        @filtered_parameters ||= parameter_filter.filter(parameters)
      rescue ActionDispatch::Http::Parameters::ParseError
        @filtered_parameters = {}
      end

    private
      def parameter_filter # :doc:
        # 注釈: env["action_dispatch.parameter_filter"] は [:foo, "bar"] のような値が入っている
        parameter_filter_for fetch_header("action_dispatch.parameter_filter") {
          return NULL_PARAM_FILTER
        }
      end

      def parameter_filter_for(filters) # :doc:
        ActiveSupport::ParameterFilter.new(filters)
      end

      ...
enddd

# https://github.com/rails/rails/blob/v7.0.5/actionpack/lib/action_controller/metal/instrumentation.rb
def process_action(*)
  ActiveSupport::ExecutionContext[:controller] = self

  raw_payload = {
    controller: self.class.name,
    action: action_name,
    request: request,
    # NOTE: raw_payloadにフィルターしたパラメータを格納
    params: request.filtered_parameters,
    headers: request.headers,
    format: request.format.ref,
    method: request.request_method,
    path: request.fullpath
  }

  # NOTE: raw_payloadを利用して"start_processing.action_controller"のイベントを作成
  ActiveSupport::Notifications.instrument("start_processing.action_controller", raw_payload)

  ActiveSupport::Notifications.instrument("process_action.action_controller", raw_payload) do |payload|
    result = super
    payload[:response] = response
    payload[:status]   = response.status
    result
  rescue => error
    payload[:status] = ActionDispatch::ExceptionWrapper.status_code_for_exception(error.class.name)
    raise
  ensure
    append_info_to_payload(payload)
  end
end

# https://github.com/rails/rails/blob/v7.0.5/actionpack/lib/action_controller/log_subscriber.rb
def start_processing(event)
  return unless logger.info?

  payload = event.payload
  # NOTE: フィルターされたパラメータを利用
  # INTERNAL_PARAMS = %w(controller action format _method only_path)
  params  = payload[:params].except(*INTERNAL_PARAMS)
  format  = payload[:format]
  format  = format.to_s.upcase if format.is_a?(Symbol)
  format  = "*/*" if format.nil?

  info "Processing by #{payload[:controller]}##{payload[:action]} as #{format}"
  info "  Parameters: #{params.inspect}" unless params.empty?
end

# https://github.com/rails/rails/blob/v7.0.5/activerecord/lib/active_record/railtie.rb#L318-L322

initializer "active_record.set_filter_attributes" do
  ActiveSupport.on_load(:active_record) do
    self.filter_attributes += Rails.application.config.filter_parameters
  end
end

# https://github.com/rails/rails/blob/v7.0.5/activerecord/lib/active_record/core.rb#L381-L396

# Specifies columns which shouldn't be exposed while calling +#inspect+.
def filter_attributes=(filter_attributes)
  @inspection_filter = nil
  @filter_attributes = filter_attributes
end

def inspection_filter # :nodoc:
  if defined?(@filter_attributes)
    @inspection_filter ||= begin
      mask = InspectionMask.new(ActiveSupport::ParameterFilter::FILTERED)
      # filter_attributesを利用して、ActiveSupport::ParameterFilterインスタンスを作成している
      ActiveSupport::ParameterFilter.new(@filter_attributes, mask: mask)
    end
  else
    superclass.inspection_filter
  end
end

# https://github.com/rails/rails/blob/v7.0.5/activerecord/lib/active_record/core.rb#L687-L701

# inspectの補足
# ActiveRecord#inspectでフィルタされたときの出力イメージ。tokenの値がフィルタされている。
# Customer.new(name: 'name', token: 'some-token')
#=> #<Customer:0x000000010bf999d8 id: nil, name: "name", token: "[FILTERED]", created_at: nil, updated_at: nil>
#
# Returns the contents of the record as a nicely formatted string.
def inspect
  # We check defined?(@attributes) not to issue warnings if the object is
  # allocated but not initialized.
  inspection = if defined?(@attributes) && @attributes
    self.class.attribute_names.filter_map do |name|
      if _has_attribute?(name)
        # 各カラムの値を出力するときにattribute_for_inspectが呼ばれる
        "#{name}: #{attribute_for_inspect(name)}"
      end
    end.join(", ")
  else
    "not initialized"
  end

  "#<#{self.class} #{inspection}>"
end

# https://github.com/rails/rails/blob/v7.0.5/activerecord/lib/active_record/attribute_methods.rb#L283-L288

def attribute_for_inspect(attr_name)
  attr_name = attr_name.to_s
  attr_name = self.class.attribute_aliases[attr_name] || attr_name
  value = _read_attribute(attr_name)
  # NOTE: 値を取得した後にformat_for_inspectが呼ばれる
  format_for_inspect(attr_name, value)
end

# https://github.com/rails/rails/blob/v7.0.5/activerecord/lib/active_record/attribute_methods.rb#L407-L421

def format_for_inspect(name, value)
  if value.nil?
    value.inspect
  else
    inspected_value = if value.is_a?(String) && value.length > 50
      "#{value[0, 50]}...".inspect
    elsif value.is_a?(Date) || value.is_a?(Time)
      %("#{value.to_fs(:inspect)}")
    else
      value.inspect
    end

    inspection_filter.filter_param(name, inspected_value)
  end
end