[mlim19]

Summary

• Redact the server token from request errors (gprofiler/client.py): exceptions raised by requests embed the request URL, which includes the token in its query string (key=<token>). When such errors were logged (e.g. a failed server health check at startup, or a failed profile upload), the token ended up in the local log file, stdout, and uploaded logs. The token is now replaced with ***, and the exception type is preserved (callers still catch Timeout specifically).
• Restrict log file permissions (gprofiler/log.py): log files are now owner-only (0600), including files left by older versions and files created on rotation. A log directory created by gProfiler is 0700.

Rootless / sudoless compatibility

• Existing directories are never modified, so --rootless runs with a user-provided --log-file (e.g. in $HOME or /tmp) are unaffected.
• Log files remain owned by and readable/writable for the user running gProfiler.
• Setting the file mode is best-effort: if it can't be applied (e.g. a writable log file owned by another user), logging continues as before.

Note

Non-root readers of /var/log/gprofiler (e.g. log shippers running without root) will need elevated access once the directory and files are recreated with the new modes.

Test plan

• Connection error to an unreachable server: message shows key=***, no raw or URL-encoded token
• As non-root: existing user dir keeps its mode; new log dir is 0700; log and rotated log are 0600; old 0644 log file becomes 0600
• black, isort, flake8

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Token redaction and log permissions retain exposure gaps, and exception reconstruction can break error handling.

4 open issues

• Preserve JSONDecodeError when redacting invalid JSON failures · New
• Redact both raw and URL-encoded API tokens · New
• Create log files atomically with restrictive permissions · New
• Harden existing rotated logs without following symlinks · New

What changed in this PR

This PR reduces server-token exposure by sanitizing request errors and restricting local log permissions.

Changes:

• Redacts encoded tokens from request exceptions.
• Restricts active and newly rotated logs to owner-only access.
• Creates new log directories with owner-only permissions.

File	Description
gprofiler/​log.py	Adds restrictive log-file and directory permissions.
gprofiler/​client.py	Adds token redaction when rethrowing request exceptions.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Permission handling still leaves exposure risks during file creation and for legacy rotated logs.

2 open issues

• Harden existing rotated logs without following symlinks
• Create log files atomically with restrictive permissions

2 resolved since last review

• Redact both raw and URL-encoded API tokens
• Preserve JSONDecodeError when redacting invalid JSON failures

_{Review effort: Balanced}