From 71f75d307641f8cd36b34556bde1e982b4379fe6 Mon Sep 17 00:00:00 2001
From: aragossa <37149556+aragossa@users.noreply.github.com>
Date: Thu, 15 Oct 2026 06:21:08 +0300
Subject: [PATCH] fix(baremetal): mask idrac session cookie and token in debug
 logs (#25781)

---
 pkg/util/redfish/bmconsole/idrac.go  | 7 ++++---
 pkg/util/redfish/bmconsole/idrac6.go | 9 +++++----
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/pkg/util/redfish/bmconsole/idrac.go b/pkg/util/redfish/bmconsole/idrac.go
index f7ded62bab..d963502ef3 100644
--- a/pkg/util/redfish/bmconsole/idrac.go
+++ b/pkg/util/redfish/bmconsole/idrac.go
@@ -26,6 +26,7 @@ import (
 	"yunion.io/x/log"
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/httputils"
+	"yunion.io/x/pkg/utils"
 
 	"yunion.io/x/onecloud/pkg/httperrors"
 )
@@ -78,7 +79,8 @@ func (r *SBMCConsole) GetIdrac7ConsoleJNLP(ctx context.Context, sku, model strin
 	if err != nil {
 		return "", errors.Wrap(err, "r.FormPost Login")
 	}
-	log.Debugf("Header: %s %s", hdr, loginResp)
+	// the header carries the session cookie and the body the ST1 token, do not print them verbatim
+	log.Debugf("Header: %d Set-Cookie, loginResp %d bytes", len(hdr["Set-Cookie"]), len(loginResp))
 	if setCookies, ok := hdr["Set-Cookie"]; ok {
 		for _, cookieHdr := range setCookies {
 			parts := strings.Split(cookieHdr, ";")
@@ -104,12 +106,11 @@ func (r *SBMCConsole) GetIdrac7ConsoleJNLP(ctx context.Context, sku, model strin
 
 	tokenPattern := regexp.MustCompile(`ST1=(\w+),ST2=`)
 	matched = tokenPattern.FindAllStringSubmatch(indexUrlStr, -1)
-	log.Debugf("%s", matched)
 	token := ""
 	if len(matched) > 0 && len(matched[0]) > 1 {
 		token = matched[0][1]
 	}
-	log.Debugf("token: %s", token)
+	log.Debugf("token: %s", utils.TruncateString(token, 16))
 	cookies["tokenvalue"] = token
 	cookies["batteriesIcon"] = "status_ok"
 	cookies["fansIcon"] = "status_ok"
diff --git a/pkg/util/redfish/bmconsole/idrac6.go b/pkg/util/redfish/bmconsole/idrac6.go
index 8daadd9ebb..a51bc50035 100644
--- a/pkg/util/redfish/bmconsole/idrac6.go
+++ b/pkg/util/redfish/bmconsole/idrac6.go
@@ -26,6 +26,7 @@ import (
 	"yunion.io/x/log"
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/httputils"
+	"yunion.io/x/pkg/utils"
 
 	"yunion.io/x/onecloud/pkg/httperrors"
 )
@@ -37,7 +38,8 @@ func (r *SBMCConsole) GetIdrac6ConsoleJNLP(ctx context.Context, sku, model strin
 	if err != nil {
 		return "", errors.Wrap(err, "r.Get start.html")
 	}
-	log.Debugf("start.html hdr %s", hdr)
+	// the header carries the session cookie, do not print it verbatim
+	log.Debugf("start.html hdr %d Set-Cookie", len(hdr["Set-Cookie"]))
 	if setCookies, ok := hdr["Set-Cookie"]; ok {
 		for _, cookieHdr := range setCookies {
 			parts := strings.Split(cookieHdr, ";")
@@ -64,7 +66,7 @@ func (r *SBMCConsole) GetIdrac6ConsoleJNLP(ctx context.Context, sku, model strin
 	if err != nil {
 		return "", errors.Wrap(err, "r.FormPost Login")
 	}
-	log.Debugf("LoginResp: %s", loginResp)
+	log.Debugf("LoginResp: %d bytes", len(loginResp))
 	forwardUrlPattern := regexp.MustCompile(`<forwardUrl>(.*)</forwardUrl>`)
 	matched := forwardUrlPattern.FindAllStringSubmatch(string(loginResp), -1)
 	indexUrlStr := ""
@@ -77,12 +79,11 @@ func (r *SBMCConsole) GetIdrac6ConsoleJNLP(ctx context.Context, sku, model strin
 
 	tokenPattern := regexp.MustCompile(`ST1=(\w+),ST2=`)
 	matched = tokenPattern.FindAllStringSubmatch(indexUrlStr, -1)
-	log.Debugf("%s", matched)
 	token := ""
 	if len(matched) > 0 && len(matched[0]) > 1 {
 		token = matched[0][1]
 	}
-	log.Debugf("token: %s", token)
+	log.Debugf("token: %s", utils.TruncateString(token, 16))
 
 	cookies["batteriesIcon"] = "status_normal"
 	cookies["fansIcon"] = "status_normal"