fix: redact signed-link signatures from the log, keeping Gravity PDF's own query arguments

[jakejackson1]

Signed PDF download links leaked their signature into the Gravity PDF log. Each signed request logs a Valid PDF Signing Request (or Invalid …) entry, and its request_uri field held the full ?expires=…&signature=… query string. Anyone with the log file, including anyone it was shared with for support, could download that PDF until the link expired.

The log redactor now masks query-string values in any link or path, relative or absolute. It keeps each argument's name, and it keeps the values of Gravity PDF's own arguments (gpdf, pid, lid, action, print, expires), because none of them is secret. That means the log can still show which PDF was requested when permalinks are turned off, and whether a rejected signed link had expired. Any other argument's value is masked, including ones the redactor doesn't know by name.

Try it

With Gravity Forms logging enabled for Gravity PDF, open a signed PDF link, then check the newest entry in the Gravity PDF log:

wp eval '
$entry = GFAPI::get_entries( 0, [], null, [ "page_size" => 1 ] )[0];
$pdf   = array_values( array_filter( GPDFAPI::get_form_pdfs( $entry["form_id"] ), function ( $pdf ) { return ! empty( $pdf["active"] ); } ) )[0];
echo ( new \GFPDF\Helper\Helper_Url_Signer() )->sign( GPDFAPI::get_mvc_class( "Model_PDF" )->get_pdf_url( $pdf["id"], $entry["id"], true ), "+1 hour" ), "\n";
'

The Valid PDF Signing Request entry logs request_uri as /pdf/<pid>/<lid>/download/?expires=…&signature=[redacted]. With plain permalinks it is /?gpdf=1&pid=…&lid=…&action=download&expires=…&signature=[redacted]. On 6.17.0 the signature is logged in full.

Test plan

• A signed PDF download logs request_uri and url with signature=[redacted], and expires intact
• With plain permalinks, the logged PDF link keeps gpdf, pid, lid and action
• An unknown argument in a logged URL (e.g. ?token=…) is masked, and a plain question mark in a message is left alone
• Test_Redact_Processor passes

More info

Why it leaked. Redact_Processor::scrub() only blanked query strings after an absolute http(s):// URL, and request_uri is a relative path. The 64-hex signature was also longer than the 28–40 hex pattern, so nothing caught it.

URL rule. scrub() matches #(?<!\S)(?=[^\s?]*/)([^\s?]*+)\?(\S*)#, which finds a whitespace-delimited token with a / before its first ?. That covers absolute, root-relative (/pdf/…?) and protocol-relative (//host/…?) links, and a path inside key="…". mask_query_values() splits the query on &, & and &, keeping each separator, so escaped URLs from esc_url() are handled and the output matches the input byte for byte apart from masked values. For each argument:

• in SAFE_QUERY_ARGS (case-insensitive): kept as is
• empty value (token=): kept, since there is nothing to hide
• a value with no name (?abc123): masked
• anything else: name=[redacted]

scrub() runs on every log message and on every string leaf in the context, so it covers any caller that logs a link, not only Model_PDF::middle_signed_url_access().

Why an allowlist. A list of sensitive names fails open: X-Amz-Signature, GoogleAccessId or a plugin's own token name would be logged in full. Masking every value except a short list of Gravity PDF's own fails closed. The list is a private constant with no filter, because a filter would let any add-on unmask a name like signature for every logger.

Hex pattern. It widens from 28–40 to 28–128 characters, so a bare 64-hex signature logged without a path in front of it (e.g. signature=…&expires=… on its own) is masked too.

Behaviour change for absolute URLs. Since 6.16 an absolute URL lost its whole query string (…file.zip?). It now keeps argument names (…file.zip?token=[redacted]&exp=[redacted]).

Performance. The URL pattern starts a match only at a token's start and scans it possessively, which keeps it linear. A draft that could start at any / took about a second on a 100 KB slash-heavy string with pcre.jit off. With masking, a 560 KB string holding 5,000 signed links takes about 3 ms with the JIT on and 8 ms with it off.

Tests. test_masks_url_query_values covers root-relative, plain-permalink, protocol-relative, mid-sentence and quoted links, an unknown secret name, a safe name in another case, a value with no name, an empty value, escaped separators, an empty query and a plain question mark. provider_message_patterns adds a bare 64-hex signature. Test_Redact_Processor, the logging tests, Test_EDD_SL_Plugin_Updater, Test_Addon, Test_Settings and Test_PDF pass, and PHPCS is clean. Checked on a local site with a real signed download, with pretty and plain permalinks.

Signatures written to existing log files before this change stay there. They expire with their links.