Repository navigation
fix(logging): mask live payment intent ids in RPC and submit logs - #1853
Merged
Merged
Conversation
Anyone who reads a payment request's payment_intent_id before the share is paid can use it up and block the payment. RPC body logging printed it in full, and the SubmitIntent trace showed 8 of its characters. - formatProto logs paymentIntentId as "…" plus its last 6 base58 characters. The response that carries it always precedes payment. - LiveSecrets holds ids that are still usable. formatProto masks a held IntentId the same way, which covers the SubmitIntent request body when a payment uses the server's id, and the submit trace does too. A released id logs in full, as every id does today.
github-actions
Bot
added
area: network
bmc08gt
marked this pull request as ready for review
October 25, 2026 15:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A payment request's
payment_intent_idcan be used up by anyone who reads it before the share is paid, which blocks the payment (paymentrequest_service.proto:192). RPC body logging printed it in full, and theSubmitIntenttrace printed 8 of its characters.While an id is still usable, logs now show
…plus its last 6 base58 characters:formatProtomasks thepaymentIntentIdfield. The response that carries it always comes before the payment, so this field is always masked. The rest of each body logs as before.LiveSecrets(in:libs:logging) holds ids that are still usable.formatProtomasks a heldIntentIdwrapper the same way, which covers theSubmitIntentrequest body when a payment uses the server's id. Thesubmitting intenttrace masks a held id too.code/cashhas no request pay path yet, so nothing callsholdhere. The pay path in #1851 holds the server's id before it submits, logs the suffix if the payment fails, and releases the id and logs it in full once the payment succeeds.Tests:
FormatProtoTest(aGetPaymentRequestResponselogs only the suffix; a heldIntentIdlogs the suffix and a released one logs in full) andLiveSecretsTest.:services:opencodegets the flipcash2 protos as a test-only dependency for the first case.