directus vulnerable to Insertion of Sensitive Information into Log File

@@ -1,11 +1,12 @@
 import { toArray } from '@directus/shared/utils';
-import type { Request, RequestHandler } from 'express';
 import { merge } from 'lodash';
-import pino, { LoggerOptions } from 'pino';
+import pino, { LoggerOptions, SerializedResponse } from 'pino';
+import type { Request, RequestHandler } from 'express';
 import pinoHTTP, { stdSerializers } from 'pino-http';
 import { URL } from 'url';
 import env from './env';
 import { getConfigFromEnv } from './utils/get-config-from-env';
+import { redactHeaderCookie } from './utils/redact-header-cookies';
 
 const pinoOptions: LoggerOptions = {
 	level: env.LOG_LEVEL || 'info',
@@ -86,8 +87,23 @@ export const expressLogger = pinoHTTP({
 		req(request: Request) {
 			const output = stdSerializers.req(request);
 			output.url = redactQuery(output.url);
+			if (output.headers?.cookie) {
+				output.headers.cookie = redactHeaderCookie(output.headers.cookie, [
+					'access_token',
+					`${env.REFRESH_TOKEN_COOKIE_NAME}`,
+				]);
+			}
 			return output;
 		},
+		res(response: SerializedResponse) {
+			if (response.headers?.['set-cookie']) {
+				response.headers['set-cookie'] = redactHeaderCookie(response.headers['set-cookie'], [
+					'access_token',
+					`${env.REFRESH_TOKEN_COOKIE_NAME}`,
+				]);
+			}
+			return response;
+		},
 	},
 }) as RequestHandler;
 

@@ -0,0 +1,42 @@
+import { describe, expect, test } from 'vitest';
+import env from '../env';
+import { redactHeaderCookie } from './redact-header-cookies';
+
+describe('redactHeaderCookie', () => {
+	describe('Given auth cookies', () => {
+		test('When it finds a refresh_token, it should redact the value', () => {
+			const tokenKey = env.REFRESH_TOKEN_COOKIE_NAME;
+			const cookieHeader = `${tokenKey}=shh;`;
+			const cookieNames = [`${tokenKey}`];
+
+			const redactedCookie = redactHeaderCookie(cookieHeader, cookieNames);
+			expect(redactedCookie).toBe(`${tokenKey}=--redacted--;`);
+		});
+		test('When it finds an access_token, it should redact the value', () => {
+			const tokenKey = 'access_token';
+			const cookieHeader = `${tokenKey}=secret;`;
+			const cookieNames = [`${tokenKey}`];
+
+			const redactedCookie = redactHeaderCookie(cookieHeader, cookieNames);
+			expect(redactedCookie).toBe(`${tokenKey}=--redacted--;`);
+		});
+		test('When it finds both an access_token and refresh_token, it should redact both values', () => {
+			const cookieHeader = `access_token=secret; ${env.REFRESH_TOKEN_COOKIE_NAME}=shhhhhhh; randomCookie=Erdtree;`;
+			const cookieNames = ['access_token', `${env.REFRESH_TOKEN_COOKIE_NAME}`];
+
+			const redactedCookie = redactHeaderCookie(cookieHeader, cookieNames);
+			expect(redactedCookie).toBe(
+				`access_token=--redacted--; ${env.REFRESH_TOKEN_COOKIE_NAME}=--redacted--; randomCookie=Erdtree;`
+			);
+		});
+	});
+	describe('Given negligible cookies', () => {
+		test('It should return the orignal value', () => {
+			const originalCookie = `Crown=Swords; Hail=Sithis;`;
+			const cookieNames = [env.REFRESH_TOKEN_COOKIE_NAME, 'access_token'];
+
+			const redactedCookie = redactHeaderCookie(originalCookie, cookieNames);
+			expect(redactedCookie).toBe(originalCookie);
+		});
+	});
+});

@@ -0,0 +1,7 @@
+export function redactHeaderCookie(cookieHeader: string, cookieNames: string[]) {
+	for (const cookieName of cookieNames) {
+		const re = new RegExp(`(${cookieName}=)([^;]+)`);
+		cookieHeader = cookieHeader.replace(re, `$1--redacted--`);
+	}
+	return cookieHeader;
+}