serilog-settings-configuration
serilog-settings-configuration copied to clipboard
8.0.1 breaks Serilog.Enrichers.Sensitive "Operators" config, currently failing silently, leaking data
Hi there,
Serilog.Enrichers.Sensitive supports masking of custom data types via Masking Operators, but it seems to no longer work after upgrading from 8.0.0 to 8.0.1.
{
"Serilog": {
"Using": [
"Serilog.Enrichers.Sensitive"
],
"Enrich": [
{
"Name": "WithSensitiveDataMasking",
"Args": {
"options": {
"MaskValue": "CUSTOM_MASK_FROM_JSON",
"Operators": [ "MyApplication.Logging.Serilog.MyCustomMaskingOperator, MyAppliation.Logging" ]
}
}
}
]
}
}
This should cause "MyApplication.Logging.Serilog.MyCustomMaskingOperator" to be invoked on each log event to add extra filtering, but after an upgrade to 8.0.1, it instead fails silently.
Fortunately, we spotted this before going to production with current dependencies and we can roll back. However, it seems likely that someone is leaking sensitive data into log files right now.