Clarify in configuration.md docs if regexp allowed for scrub_fields

[eliotsykes]

I'm looking at an app that contains many sensitive fields so I'd like to default to scrubbing all fields as they shouldn't be logged to a 3rd party (no offence intended Rollbar).

Its unclear from the docs (configuration.md) if the scrub_fields config accepts a regex, e.g. its not clear if this would work.

SCRUB_ALL_FIELDS_PATTERN = /.+/
Rollbar.configuration.scrub_fields += [SCRUB_ALL_FIELDS_PATTERN]

[jondeandres]

Hi @eliotsykes, thanks for reaching out.

When we filter the parameters we build a regex in this way:

sensitive_params_regexp = Regexp.new(sensitive_params.map{ |val| Regexp.escape(val.to_s).to_s }.join('|'), true)

So I'd say that regex expressions doesn't work for scrubbing parameters. We have in our roadmap improve this functionality, but I can't tell you right now when that will be ready.

[eliotsykes]

Thanks for the fast response @jondeandres! Until the feature is added, is there a recommended workaround to prevent all request params from being logged to Rollbar?

[jondeandres]

Hey @eliotsykes, you could monkey patch this method in this module, https://github.com/rollbar/rollbar-gem/blob/master/lib/rollbar/request_data_extractor.rb#L191-L213, so it generates a new Hash with obfuscated values.

I think we should probably make scrubbing more powerful, so thank you for open an issue 😄

[eliotsykes]

Yep - at the moment this makes it less straightforward to recommend Rollbar to businesses operating under strict PII regulations.

[jondeandres]

@eliotsykes what requirements do you have? We could try to work on this in few days.

[eliotsykes]

There's many request params (100+) from many forms (and growing) that all contain PII data.

This PII data ought not to be exposed to 3rd parties (including Rollbar). Exception messages are fine as they contain no PII. Its the request params that often contain personally identifiable info (e.g. birthday, financial info, more).

[jondeandres]

aha, what features would you like to have?

• scrub all params? this can be easily done
• scrub by regex? this will take a little more time but it's doable

[eliotsykes]

scrub all params

would be absolutely fine for right now.

[eliotsykes]

👍 Brilliant, thanks @jondeandres!

[jondeandres]

hey @eliotsykes, we hope your experience with this feature is successful. ping us if you have any problem with something.

btw, we'll release this today or tomorrow.