mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2024-12-22 09:05:43 +00:00
Code Issues 25 Releases Wiki Activity

Fixed #35646 -- Extended SafeExceptionReporterFilter.hidden_settings to treat AUTH as a sensitive match.

Browse Source 
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
This commit is contained in:
Markus Holtermann 2024-07-31 11:44:49 -03:00 committed by nessita
parent 615c80aba6
commit aa90795050
4 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
django/views/debug.py
View File

@ -113,7 +113,7 @@ class SafeExceptionReporterFilter:
cleansed_substitute = "********************"
hidden_settings = _lazy_re_compile(
"API|TOKEN|KEY|SECRET|PASS|SIGNATURE|HTTP_COOKIE", flags=re.I
"API|AUTH|TOKEN|KEY|SECRET|PASS|SIGNATURE|HTTP_COOKIE", flags=re.I
)
def cleanse_setting(self, key, value):

6
docs/howto/error-reporting.txt
View File

@ -282,7 +282,11 @@ following attributes and methods:
import re
re.compile(r"API|TOKEN|KEY|SECRET|PASS|SIGNATURE|HTTP_COOKIE", flags=re.IGNORECASE)
re.compile(r"API|AUTH|TOKEN|KEY|SECRET|PASS|SIGNATURE|HTTP_COOKIE", flags=re.IGNORECASE)
.. versionchanged:: 5.2
The term ``AUTH`` was added.
.. method:: is_active(request)

3
docs/releases/5.2.txt
View File

@ -150,7 +150,8 @@ Email
Error Reporting
~~~~~~~~~~~~~~~
* ...
* The attribute :attr:`.SafeExceptionReporterFilter.hidden_settings` now
treats values as sensitive if their name includes ``AUTH``.
File Storage
~~~~~~~~~~~~

4
tests/view_tests/tests/test_debug.py
View File

@ -1557,7 +1557,8 @@ class ExceptionReporterFilterTests(
"SECRET_KEY_FALLBACKS",
"PASSWORD",
"API_KEY",
"AUTH_TOKEN",
"SOME_TOKEN",
"MY_AUTH",
]
def test_non_sensitive_request(self):
@ -1885,6 +1886,7 @@ class ExceptionReporterFilterTests(
"PASSWORD": "super secret",
"SECRET_VALUE": "super secret",
"SOME_TOKEN": "super secret",
"THE_AUTH": "super secret",
}
request = self.rf.get("/", headers=headers)
reporter_filter = SafeExceptionReporterFilter()