feat: add ability for users to enable data message logging (#95)

* feat: add ability for users to enable data message logging

Author: philasmar

README.md

@@ -311,6 +311,14 @@ We welcome community contributions and pull requests. See [CONTRIBUTING.md](./CO
 # Security
 The AWS Message Processing Framework for .NET relies on the [AWS SDK for .NET](https://github.com/aws/aws-sdk-net) for communicating with AWS. Refer to the [security section](https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/security.html) in the [AWS SDK for .NET Developer Guide](https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/welcome.html) for more information.
 
+The framework does not log data messages sent by the user for security purposes. If users want to enable this functionality for debugging purposes, you need to call `EnableDataMessageLogging()` in the AWS Message Bus as follows:
+```csharp
+builder.Services.AddAWSMessageBus(bus =>
+{
+    builder.EnableDataMessageLogging();
+});
+```
+
 If you discover a potential security issue, refer to the [security policy](https://github.com/awslabs/aws-dotnet-messaging/security/policy) for reporting information.
 
 # Additional Resources

sampleapps/PublisherAPI/Program.cs

@@ -32,6 +32,9 @@
             PropertyNamingPolicy= JsonNamingPolicy.CamelCase,
         };
     });
+
+    // Logging data messages is disabled by default to protect sensitive user data. If you want this enabled, uncomment the line below.
+    // builder.EnableDataMessageLogging();
 });
 // Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
 builder.Services.AddEndpointsApiExplorer();

sampleapps/PublisherAPI/appsettings.json

@@ -40,6 +40,7 @@
                     "EndpointID": "default"
                 }
             }
-        ]
+        ],
+        "LogMessageContent": false
     }
 }

sampleapps/SubscriberService/Program.cs

@@ -39,6 +39,9 @@ await Host.CreateDefaultBuilder(args)
                     PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
                 };
             });
+
+            // Logging data messages is disabled by default to protect sensitive user data. If you want this enabled, uncomment the line below.
+            // builder.EnableDataMessageLogging();
         })
         .AddOpenTelemetry()
             .ConfigureResource(resource => resource.AddService("SubscriberService"))

src/AWS.Messaging/Configuration/IMessageBusBuilder.cs

@@ -76,7 +76,7 @@ IMessageBusBuilder AddMessageHandler<THandler, TMessage>(string? messageTypeIden
     /// </summary>
     /// <param name="suffix">The suffix to append to the message source.</param>
     IMessageBusBuilder AddMessageSourceSuffix(string suffix);
-    
+
     /// <summary>
     /// Retrieve the Message Processing Framework section from <see cref="IConfiguration"/>
     /// and apply the Message bus configuration based on that section.
@@ -90,4 +90,11 @@ IMessageBusBuilder AddMessageHandler<THandler, TMessage>(string? messageTypeIden
     /// <param name="serviceDescriptor">The service descriptor for the added service.</param>
     /// <returns></returns>
     IMessageBusBuilder AddAdditionalService(ServiceDescriptor serviceDescriptor);
+
+    /// <summary>
+    /// Enables the visibility of data messages in the logging framework, exception handling and other areas.
+    /// If this is enabled, messages sent by this framework will be visible in plain text across the framework's components.
+    /// This means any sensitive user data sent by this framework will be visible in logs, any exceptions thrown and others.
+    /// </summary>
+    IMessageBusBuilder EnableMessageContentLogging();
 }

src/AWS.Messaging/Configuration/IMessageConfiguration.cs

@@ -67,4 +67,11 @@ public interface IMessageConfiguration
     /// computed by the framework in the absence of a user-defined one.
     /// </summary>
     string? SourceSuffix { get; set; }
+
+    /// <summary>
+    /// Controls the visibility of data messages in the logging framework, exception handling and other areas.
+    /// If this is enabled, messages sent by this framework will be visible in plain text across the framework's components.
+    /// This means any sensitive user data sent by this framework will be visible in logs, any exceptions thrown and others.
+    /// </summary>
+    bool LogMessageContent { get; set; }
 }

src/AWS.Messaging/Configuration/Internal/ApplicationSettings.cs

@@ -39,6 +39,13 @@ public class ApplicationSettings
     /// </summary>
     public ICollection<SQSPoller> SQSPollers { get; set; } = default!;
 
+    /// <summary>
+    /// Controls the visibility of data messages in the logging framework, exception handling and other areas.
+    /// If this is enabled, messages sent by this framework will be visible in plain text across the framework's components.
+    /// This means any sensitive user data sent by this framework will be visible in logs, any exceptions thrown and others.
+    /// </summary>
+    public bool? LogMessageContent { get; set; } = default;
+
     /// <summary>
     /// Represents an SQS publisher configuration.
     /// </summary>

src/AWS.Messaging/Configuration/MessageBusBuilder.cs

@@ -125,7 +125,7 @@ public IMessageBusBuilder AddSQSPoller(string queueUrl, Action<SQSMessagePollerO
             VisibilityTimeoutExtensionHeartbeatInterval = sqsMessagePollerOptions.VisibilityTimeoutExtensionHeartbeatInterval,
             WaitTimeSeconds = sqsMessagePollerOptions.WaitTimeSeconds,
             IsSQSExceptionFatal = sqsMessagePollerOptions.IsSQSExceptionFatal
-            
+
         };
 
         _messageConfiguration.MessagePollerConfigurations.Add(sqsMessagePollerConfiguration);
@@ -159,7 +159,7 @@ public IMessageBusBuilder AddMessageSourceSuffix(string suffix)
         _messageConfiguration.SourceSuffix = suffix;
         return this;
     }
-    
+
     /// <inheritdoc/>
     public IMessageBusBuilder LoadConfigurationFromSettings(IConfiguration configuration)
     {
@@ -239,6 +239,9 @@ public IMessageBusBuilder LoadConfigurationFromSettings(IConfiguration configura
             }
         }
 
+        if (settings.LogMessageContent != null)
+            _messageConfiguration.LogMessageContent = settings.LogMessageContent ?? false;
+
         return this;
     }
 
@@ -261,8 +264,17 @@ public IMessageBusBuilder AddAdditionalService(ServiceDescriptor serviceDescript
         return this;
     }
 
+    /// <inheritdoc/>
+    public IMessageBusBuilder EnableMessageContentLogging()
+    {
+        _messageConfiguration.LogMessageContent = true;
+        return this;
+    }
+
     internal void Build(IServiceCollection services)
     {
+        LoadConfigurationFromEnvironment();
+
         // Make sure there is at least the default null implementation of the logger to injected so that
         // the DI constructors can be satisfied.
         services.TryAdd(ServiceDescriptor.Singleton<ILoggerFactory, NullLoggerFactory>());
@@ -330,4 +342,14 @@ internal void Build(IServiceCollection services)
             services.Add(service);
         }
     }
+
+    /// <summary>
+    /// Retrieve Message Processing Framework configuration from environment variables.
+    /// </summary>
+    private void LoadConfigurationFromEnvironment()
+    {
+        var logMessageContentEnvVar = Environment.GetEnvironmentVariable("AWSMESSAGING_LOGMESSAGECONTENT");
+        if (!string.IsNullOrEmpty(logMessageContentEnvVar) && bool.TryParse(logMessageContentEnvVar, out var logMessageContent))
+            _messageConfiguration.LogMessageContent = logMessageContent;
+    }
 }

src/AWS.Messaging/Configuration/MessageConfiguration.cs

@@ -51,4 +51,7 @@ public class MessageConfiguration : IMessageConfiguration
 
     /// <inheritdoc/>
     public string? SourceSuffix { get; set; }
-} 
+
+    /// <inheritdoc/>
+    public bool LogMessageContent { get; set; }
+}

src/AWS.Messaging/Serialization/EnvelopeSerializer.cs

@@ -109,9 +109,21 @@ public async ValueTask<string> SerializeAsync<T>(MessageEnvelope<T> envelope)
             var jsonString = blob.ToJsonString();
             var serializedMessage = await InvokePostSerializationCallback(jsonString);
 
-            _logger.LogTrace("Serialized the MessageEnvelope object as the following raw string:\n{SerializedMessage}", serializedMessage);
+            if (_messageConfiguration.LogMessageContent)
+            {
+                _logger.LogTrace("Serialized the MessageEnvelope object as the following raw string:\n{SerializedMessage}", serializedMessage);
+            }
+            else
+            {
+                _logger.LogTrace("Serialized the MessageEnvelope object to a raw string");
+            }
             return serializedMessage;
         }
+        catch (JsonException) when (!_messageConfiguration.LogMessageContent)
+        {
+            _logger.LogError("Failed to serialize the MessageEnvelope into a raw string");
+            throw new FailedToSerializeMessageEnvelopeException("Failed to serialize the MessageEnvelope into a raw string");
+        }
         catch (Exception ex)
         {
             _logger.LogError(ex, "Failed to serialize the MessageEnvelope into a raw string");
@@ -142,7 +154,7 @@ public async ValueTask<ConvertToEnvelopeResult> ConvertToEnvelopeAsync(Message s
 
             if (Activator.CreateInstance(messageEnvelopeType) is not MessageEnvelope finalMessageEnvelope)
             {
-                _logger.LogError("Failed to create a messageEnvelope of type '{MessageEnvelopeType}'", messageEnvelopeType.FullName);
+                _logger.LogError($"Failed to create a {nameof(MessageEnvelope)} of type '{{MessageEnvelopeType}}'", messageEnvelopeType.FullName);
                 throw new InvalidOperationException($"Failed to create a {nameof(MessageEnvelope)} of type '{messageEnvelopeType.FullName}'");
             }
 
@@ -163,6 +175,11 @@ public async ValueTask<ConvertToEnvelopeResult> ConvertToEnvelopeAsync(Message s
             _logger.LogTrace("Created a generic {MessageEnvelopeName} of type '{MessageEnvelopeType}'", nameof(MessageEnvelope), result.Envelope.GetType());
             return result;
         }
+        catch (JsonException) when (!_messageConfiguration.LogMessageContent)
+        {
+            _logger.LogError("Failed to create a {MessageEnvelopeName}", nameof(MessageEnvelope));
+            throw new FailedToCreateMessageEnvelopeException($"Failed to create {nameof(MessageEnvelope)}");
+        }
         catch (Exception ex)
         {
             _logger.LogError(ex, "Failed to create a {MessageEnvelopeName}", nameof(MessageEnvelope));

src/AWS.Messaging/Serialization/MessageSerializer.cs

@@ -29,9 +29,22 @@ public object Deserialize(string message, Type deserializedType)
         try
         {
             var jsonSerializerOptions = _messageConfiguration.SerializationOptions.SystemTextJsonOptions;
-            _logger.LogTrace("Deserializing the following message into type '{DeserializedType}':\n{Message}", deserializedType, message);
+            if (_messageConfiguration.LogMessageContent)
+            {
+                _logger.LogTrace("Deserializing the following message into type '{DeserializedType}':\n{Message}", deserializedType, message);
+            }
+            else
+            {
+                _logger.LogTrace("Deserializing the following message into type '{DeserializedType}'", deserializedType);
+            }
+
             return JsonSerializer.Deserialize(message, deserializedType, jsonSerializerOptions) ?? throw new JsonException("The deserialized application message is null.");
         }
+        catch (JsonException) when (!_messageConfiguration.LogMessageContent)
+        {
+            _logger.LogError("Failed to deserialize application message into an instance of {DeserializedType}.", deserializedType);
+            throw new FailedToDeserializeApplicationMessageException($"Failed to deserialize application message into an instance of {deserializedType}.");
+        }
         catch (Exception ex)
         {
             _logger.LogError(ex, "Failed to deserialize application message into an instance of {DeserializedType}.", deserializedType);
@@ -47,9 +60,22 @@ public string Serialize(object message)
         {
             var jsonSerializerOptions = _messageConfiguration.SerializationOptions.SystemTextJsonOptions;
             var jsonString = JsonSerializer.Serialize(message, jsonSerializerOptions);
-            _logger.LogTrace("Serialized the message object as the following raw string:\n{JsonString}", jsonString);
+            if (_messageConfiguration.LogMessageContent)
+            {
+                _logger.LogTrace("Serialized the message object as the following raw string:\n{JsonString}", jsonString);
+            }
+            else
+            {
+                _logger.LogTrace("Serialized the message object to a raw string with a content length of {ContentLength}.", jsonString.Length);
+            }
+
             return jsonString;
         }
+        catch (JsonException) when (!_messageConfiguration.LogMessageContent)
+        {
+            _logger.LogError("Failed to serialize application message into a string");
+            throw new FailedToSerializeApplicationMessageException("Failed to serialize application message into a string");
+        }
         catch (Exception ex)
         {
             _logger.LogError(ex, "Failed to serialize application message into a string");