1 files changed, 15 insertions, 1 deletions
diff --git a/app/services/web_hooks/log_execution_service.rb b/app/services/web_hooks/log_execution_service.rb
index 448bb7d4097..b1da0c1642f 100644
--- a/app/services/web_hooks/log_execution_service.rb
+++ b/app/services/web_hooks/log_execution_service.rb
@@ -17,18 +17,32 @@ module WebHooks
     end
 
     def execute
-      update_hook_failure_state if WebHook.web_hooks_disable_failed?(hook)
+      update_hook_failure_state
       log_execution
     end
 
     private
 
     def log_execution
+      mask_response_headers
+
       log_data[:request_headers]['X-Gitlab-Token'] = _('[REDACTED]') if hook.token?
 
       WebHookLog.create!(web_hook: hook, **log_data)
     end
 
+    def mask_response_headers
+      return unless hook.url_variables?
+      return unless log_data.key?(:response_headers)
+
+      variables_map = hook.url_variables.invert.transform_values { "{#{_1}}" }
+      regex = Regexp.union(variables_map.keys)
+
+      log_data[:response_headers].transform_values! do |value|
+        regex === value ? value.gsub(regex, variables_map) : value
+      end
+    end
+
     # Perform this operation within an `Gitlab::ExclusiveLease` lock to make it
     # safe to be called concurrently from different workers.
     def update_hook_failure_state