SIEM delivery logs the full sink URL, credentials and all

[rubenvdlinde]

SiemTransport::deliverWebhook() posts to $sink->getEndpoint(). A non-2xx answer throws a Guzzle exception whose message names the full URL, and DeliverSiemEventsJob.php line 72 logs that message. A sink URL that carries a token in a query parameter therefore lands in nextcloud.log. SiemService.php line 383 has the same shape.

Found while fixing #707, which was the same defect on the breach path. This one is smaller: the endpoint is admin configuration, not something a user typed, and no user id is stamped beside it. It is still a credential in a log file.

Two neighbours worth checking in the same pass: ScanExpiringSecretsJob.php line 110 and ScanCertificateExpiryJob.php line 105 both log a record id together with an unbounded exception message.

The connection reporter is already clean: reportSiemDrain() carries counts, and atHost() names a host only, which REQ-KEEPIQ-CONN-003 requires.

What to do

• Log the exception class and HTTP status, and the sink's HOST, never the full URL or the message. fix(breach): a failed lookup logs the exception class and status, never its message #727 added outcomeOf() on the breach path; reuse that shape.
• Add a test that throws an exception whose message contains a URL with a token and asserts the logged line contains neither.

Done when no log line written by the SIEM path can contain a sink URL or a token.

🤖 Generated with Claude Code

[github-actions]

Thank you for opening this issue! It has been assigned to @rubenvdlinde for review.

What happens next:

1. A maintainer will review this issue and determine the appropriate action
2. If accepted, it may be converted into an OpenSpec change for structured development
3. You will be notified of any status changes

Triage labels:

• triage:accept-feature — accepted as a new feature
• triage:accept-bugfix — accepted as a bug fix
• triage:needs-info — more information needed
• triage:wontfix — will not be addressed
• triage:duplicate — duplicate of another issue

[rubenvdlinde]

One more place the same message leaks, and this one reaches the database and the admin UI, not only the log.

lib/Service/SiemService.php:254 stores substr($exception->getMessage(), 0, 500) as the queue item's lastError, and :271 stores the same text as the sink's lastError. The SIEM section in admin settings shows the sink's lastError. A Guzzle exception message names the full request URL, so a webhook URL with a token in its query string or userinfo ends up in oc_keepiq_siem_queue and oc_keepiq_siem_sinks rows and on screen.

Fix direction: store the same sanitized outcome you log (exception class, HTTP status, sink host), never getMessage(). The test that asserts the log line has no token can assert the same for both lastError columns.

Live check: add a webhook sink pointing at https://user:secret@httpbin.org/status/500?token=abc, trigger a delivery, and open the SIEM section. If the error text shows secret or abc, it holds.

Found by the keepiq capability matrix (row audit-07, openspec/parity/capabilities.json on development at 06f25bf). Adding the security label: an admin screen and a database table hold a credential they must not.