Fixes pentest issue DG25-32 from 2025-09-02

crates/defguard_common/src/db/models/settings.rs

@@ -1,4 +1,4 @@
-use std::collections::HashMap;
+use std::{collections::HashMap, fmt};
 
 use crate::{global_value, secret::SecretStringWrapper};
 use serde::{Deserialize, Serialize};
@@ -77,7 +77,7 @@ impl LdapSyncStatus {
     }
 }
 
-#[derive(Clone, Debug, Deserialize, PartialEq, Patch, Serialize, Default)]
+#[derive(Clone, Deserialize, PartialEq, Patch, Serialize, Default)]
 #[patch(attribute(derive(Deserialize, Serialize, Debug)))]
 pub struct Settings {
     // Modules
@@ -144,6 +144,85 @@ pub struct Settings {
     pub gateway_disconnect_notifications_reconnect_notification_enabled: bool,
 }
 
+// Implement manually to avoid exposing the license key.
+impl fmt::Debug for Settings {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Settings")
+            .field("openid_enabled", &self.openid_enabled)
+            .field("wireguard_enabled", &self.wireguard_enabled)
+            .field("webhooks_enabled", &self.webhooks_enabled)
+            .field("worker_enabled", &self.worker_enabled)
+            .field("challenge_template", &self.challenge_template)
+            .field("instance_name", &self.instance_name)
+            .field("main_logo_url", &self.main_logo_url)
+            .field("nav_logo_url", &self.nav_logo_url)
+            .field("smtp_server", &self.smtp_server)
+            .field("smtp_port", &self.smtp_port)
+            .field("smtp_encryption", &self.smtp_encryption)
+            .field("smtp_user", &self.smtp_user)
+            .field("smtp_password", &self.smtp_password)
+            .field("smtp_sender", &self.smtp_sender)
+            .field(
+                "enrollment_vpn_step_optional",
+                &self.enrollment_vpn_step_optional,
+            )
+            .field(
+                "enrollment_welcome_message",
+                &self.enrollment_welcome_message,
+            )
+            .field("enrollment_welcome_email", &self.enrollment_welcome_email)
+            .field(
+                "enrollment_welcome_email_subject",
+                &self.enrollment_welcome_email_subject,
+            )
+            .field(
+                "enrollment_use_welcome_message_as_email",
+                &self.enrollment_use_welcome_message_as_email,
+            )
+            .field("uuid", &self.uuid)
+            .field("ldap_url", &self.ldap_url)
+            .field("ldap_bind_username", &self.ldap_bind_username)
+            .field("ldap_bind_password", &self.ldap_bind_password)
+            .field("ldap_group_search_base", &self.ldap_group_search_base)
+            .field("ldap_user_search_base", &self.ldap_user_search_base)
+            .field("ldap_user_obj_class", &self.ldap_user_obj_class)
+            .field("ldap_group_obj_class", &self.ldap_group_obj_class)
+            .field("ldap_username_attr", &self.ldap_username_attr)
+            .field("ldap_groupname_attr", &self.ldap_groupname_attr)
+            .field("ldap_group_member_attr", &self.ldap_group_member_attr)
+            .field("ldap_member_attr", &self.ldap_member_attr)
+            .field("ldap_use_starttls", &self.ldap_use_starttls)
+            .field("ldap_tls_verify_cert", &self.ldap_tls_verify_cert)
+            .field("ldap_sync_status", &self.ldap_sync_status)
+            .field("ldap_enabled", &self.ldap_enabled)
+            .field("ldap_sync_enabled", &self.ldap_sync_enabled)
+            .field("ldap_is_authoritative", &self.ldap_is_authoritative)
+            .field("ldap_uses_ad", &self.ldap_uses_ad)
+            .field("ldap_sync_interval", &self.ldap_sync_interval)
+            .field(
+                "ldap_user_auxiliary_obj_classes",
+                &self.ldap_user_auxiliary_obj_classes,
+            )
+            .field("ldap_user_rdn_attr", &self.ldap_user_rdn_attr)
+            .field("ldap_sync_groups", &self.ldap_sync_groups)
+            .field("openid_create_account", &self.openid_create_account)
+            .field("openid_username_handling", &self.openid_username_handling)
+            .field(
+                "gateway_disconnect_notifications_enabled",
+                &self.gateway_disconnect_notifications_enabled,
+            )
+            .field(
+                "gateway_disconnect_notifications_inactivity_threshold",
+                &self.gateway_disconnect_notifications_inactivity_threshold,
+            )
+            .field(
+                "gateway_disconnect_notifications_reconnect_notification_enabled",
+                &self.gateway_disconnect_notifications_reconnect_notification_enabled,
+            )
+            .finish_non_exhaustive()
+    }
+}
+
 impl Settings {
     pub async fn get<'e, E>(executor: E) -> Result<Option<Self>, sqlx::Error>
     where
@@ -465,4 +544,17 @@ mod test {
         settings.smtp_password = Some(SecretStringWrapper::from_str("hunter2").unwrap());
         assert!(settings.smtp_configured());
     }
+
+    #[test]
+    fn dg25_32_test_dont_expose_license_key() {
+        let key = "0000000000000000";
+        let settings = Settings {
+            license: Some(key.to_string()),
+            ..Default::default()
+        };
+
+        let debug = format!("{settings:?}");
+        assert!(!debug.contains("license"));
+        assert!(!debug.contains(key));
+    }
 }