mirror of
https://github.com/XRPLF/rippled.git
synced 2026-09-27 23:38:08 +00:00
91b440820a
An XRP account address is a public ledger identifier drawn from an enumerable set. An unsalted hash of it is reversible by lookup, so it protected nothing and only broke the join against explorers, RPC responses and logs that show the same address. - pathfind_source_account and pathfind_dest_account carry the request's r-address. A value that does not parse as an r-address is not emitted, so a malformed or mistaken request value never reaches a span. Both handlers share setAccountAttribute() in PathFindSpanAttributes.h. - pathfind_dest_currency is to_string(Asset): "XRP", "<issuer>/<CUR>", or the MPT issuance id. - The collector's attributes/hash processor is removed. No layer hashes. - redactAccount() stays available; its header no longer claims to sit in the emit path.
63 lines
2.2 KiB
C++
63 lines
2.2 KiB
C++
#pragma once
|
|
|
|
/**
|
|
* Account-address redaction helper for telemetry span attributes.
|
|
*
|
|
* A single pure helper that turns a string into a short, stable,
|
|
* obfuscated token, for a span attribute whose value should not be stored
|
|
* in the clear and is hard to guess.
|
|
*
|
|
* Not applied to any span today. Account addresses are public ledger
|
|
* identifiers, so the path-finding spans emit them raw (see
|
|
* PathFindSpanNames.h) and no collector processor hashes them. Use this
|
|
* helper only for a value that is genuinely private, and document the
|
|
* reason at the attribute constant.
|
|
*
|
|
* The returned token is the first 16 hex characters (lowercase) of the
|
|
* SHA-512Half digest of the input. It is deterministic (same input
|
|
* always maps to the same token) so spans for one value still correlate
|
|
* across nodes and restarts.
|
|
*
|
|
* The hash is unsalted, so it is obfuscation, not a secrecy guarantee.
|
|
* It hides a value only when that value is hard to guess: for an input
|
|
* drawn from a small or enumerable set, such as an account address, an
|
|
* observer can rebuild the value->token mapping by lookup, which is why
|
|
* account addresses are emitted raw instead. A salt is intentionally
|
|
* omitted because it would break cross-node/restart correlation, which is
|
|
* the reason for hashing rather than dropping.
|
|
*
|
|
* @note This function is pure and reentrant: it holds no global state,
|
|
* performs no I/O, and is safe to call concurrently from any thread.
|
|
*
|
|
* Usage example:
|
|
* @code
|
|
* #include <xrpl/telemetry/Redaction.h>
|
|
* using namespace xrpl::telemetry;
|
|
*
|
|
* auto const token = redactAccount(value); // 16 lowercase hex chars
|
|
* @endcode
|
|
*
|
|
* Edge case (empty input yields empty output):
|
|
* @code
|
|
* assert(redactAccount("") == "");
|
|
* @endcode
|
|
*/
|
|
|
|
#include <string>
|
|
#include <string_view>
|
|
|
|
namespace xrpl::telemetry {
|
|
|
|
/**
|
|
* Hash a value into a short, stable, obfuscated token.
|
|
*
|
|
* @param addr The value to redact. Named for its original use on account
|
|
* addresses; any string can be passed.
|
|
* @return The first 16 lowercase hex characters of sha512Half(addr),
|
|
* or an empty string when @p addr is empty.
|
|
*/
|
|
[[nodiscard]] std::string
|
|
redactAccount(std::string_view addr);
|
|
|
|
} // namespace xrpl::telemetry
|