filter out password in xml string

Question

We're storing the xml communications with an external service in a text in the db and in a before_create I've got the following:

  # filter opera password
  def remove_password!
    self.request.gsub!  /UserPassword\>[^\<]*\<\//,
                        'UserPassword>[FILTERED]</'
  end

Is there a better, safer way of doing it?

Answer 1

That depends on how confident you are that neither of these cases will be true:

• Another tag like will be introduced that you will want to leave unfiltered
• No nested tags will appear within the tag

An example of the last would be:

<UserPassword><for name="boy">Sue</for></UserPassword>

It seems your assumptions are safe, but if you want to be certain, go with

self.request.gsub! /\<UserPassword\>.+?\</UserPassword\>/gm, '<UserPassword>[FILTERED]</UserPassword>'

By eliminating the greediness of the regex, you can match the exact tag you mean and reduce the assumptions that will come back and bite you.