Merge branch 'secure-request-uris' into 'master'

Filter out sensitive parameters of metrics data

See merge request !4748

1 files changed, 5 insertions, 1 deletions

diff --git a/lib/gitlab/metrics/rack_middleware.rb b/lib/gitlab/metrics/rack_middleware.rb
index 3fe27779d03..e61670f491c 100644
--- a/lib/gitlab/metrics/rack_middleware.rb
+++ b/lib/gitlab/metrics/rack_middleware.rb
@@ -35,7 +35,7 @@ module Gitlab
       def transaction_from_env(env)
         trans = Transaction.new
 
-        trans.set(:request_uri, env['REQUEST_URI'])
+        trans.set(:request_uri, filtered_path(env))
         trans.set(:request_method, env['REQUEST_METHOD'])
 
         trans
@@ -54,6 +54,10 @@ module Gitlab
 
       private
 
+      def filtered_path(env)
+        ActionDispatch::Request.new(env).filtered_path.presence || env['REQUEST_URI']
+      end
+
       def endpoint_paths_cache
         @endpoint_paths_cache ||= Hash.new do |hash, http_method|
           hash[http_method] = Hash.new do |inner_hash, raw_path|