Redact commonly used credential parameters during logging (#1154)

src/library/Box/EventManager.php

@@ -15,6 +15,7 @@
 class Box_EventManager implements \Box\InjectionAwareInterface
 {
     protected $di;
+    protected $sensitiveParameters = ['password', 'pass', 'passwd', 'password_confirmation'];
 
     /**
      * @param mixed $di
@@ -44,6 +45,10 @@ class Box_EventManager implements \Box\InjectionAwareInterface
         $subject = $data['subject'] ?? null;
         $params = $data['params'] ?? null;
 
+        if (is_array($params)) {
+            $params = $this->hideSensitiveParameters($params);
+        }
+
         if (BB_DEBUG) {
             $this->di['logger']->debug($event.': '.var_export($params, 1));
         }
@@ -57,6 +62,25 @@ class Box_EventManager implements \Box\InjectionAwareInterface
         return $e->getReturnValue();
     }
 
+    /**
+     * Hide some of the known sensitive parameters.
+     * 
+     * @param array $params
+     * @return array
+     */
+    public function hideSensitiveParameters($params)
+    {
+        if (is_array($params)) {
+            foreach ($params as $key => $value) {
+                if (in_array($key, $this->sensitiveParameters)) {
+                    $params[$key] = '********';
+                }
+            }
+        }
+
+        return $params;
+    }
+
     /**
      * @param Box_EventDispatcher $disp
      * @param string              $event