Skip to content

fix(wopi): Mark wopi token as sensitive also on controller level#5564

Open
nickvergessen wants to merge 1 commit intomainfrom
bugfix/noid/mark-wopi-token-sensitive
Open

fix(wopi): Mark wopi token as sensitive also on controller level#5564
nickvergessen wants to merge 1 commit intomainfrom
bugfix/noid/mark-wopi-token-sensitive

Conversation

@nickvergessen
Copy link
Copy Markdown
Member

@nickvergessen nickvergessen commented Apr 14, 2026

Already done one level deeper:

#[\SensitiveParameter]
string $token,

But still leaks here in case of exceptions:

      {
        "file": "/var/www/html/custom_apps/richdocuments/lib/Controller/WopiController.php",
        "line": 390,
        "function": "fopen",
        "class": "OC\\Files\\Node\\File",
        "type": "->",
        "args": [
          "rb"
        ]
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 204,
        "function": "getFile",
        "class": "OCA\\Richdocuments\\Controller\\WopiController",
        "type": "->",
        "args": [
          "1085",
          "z9…LEAKED…VV"
        ]
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 118,
        "function": "executeController",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->",
        "args": [
          {
            "__class__": "OCA\\Richdocuments\\Controller\\WopiController"
          },
          "getFile"
        ]
      },

Checklist

  • Code is properly formatted
  • Sign-off message is added to all commits
  • Documentation (manuals or wiki) has been updated or is not required

Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen nickvergessen self-assigned this Apr 14, 2026
@nickvergessen nickvergessen added bug Something isn't working 3. to review Ready to be reviewed labels Apr 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to review Ready to be reviewed bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant