mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2024-12-22 17:16:24 +00:00
Code Issues 25 Releases Wiki Activity

Fixed #35646 -- Extended SafeExceptionReporterFilter.hidden_settings to treat AUTH as a sensitive match.

Browse Source 
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
This commit is contained in:
Markus Holtermann 2024-07-31 11:44:49 -03:00 committed by nessita
parent 615c80aba6
commit aa90795050
4 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
django/views/debug.py
View File

@ -113,7 +113,7 @@ class SafeExceptionReporterFilter:
cleansed_substitute = "********************" cleansed_substitute = "********************"
hidden_settings = _lazy_re_compile( hidden_settings = _lazy_re_compile(
"API|TOKEN|KEY|SECRET|PASS|SIGNATURE|HTTP_COOKIE", flags=re.I "API|AUTH|TOKEN|KEY|SECRET|PASS|SIGNATURE|HTTP_COOKIE", flags=re.I
) )
def cleanse_setting(self, key, value): def cleanse_setting(self, key, value):

6
docs/howto/error-reporting.txt
View File

@ -282,7 +282,11 @@ following attributes and methods:
import re import re
re.compile(r"API|TOKEN|KEY|SECRET|PASS|SIGNATURE|HTTP_COOKIE", flags=re.IGNORECASE) re.compile(r"API|AUTH|TOKEN|KEY|SECRET|PASS|SIGNATURE|HTTP_COOKIE", flags=re.IGNORECASE)
.. versionchanged:: 5.2
The term ``AUTH`` was added.
.. method:: is_active(request) .. method:: is_active(request)

3
docs/releases/5.2.txt
View File

@ -150,7 +150,8 @@ Email
Error Reporting Error Reporting
~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~
* ... * The attribute :attr:`.SafeExceptionReporterFilter.hidden_settings` now
treats values as sensitive if their name includes ``AUTH``.
File Storage File Storage
~~~~~~~~~~~~ ~~~~~~~~~~~~

4
tests/view_tests/tests/test_debug.py
View File

@ -1557,7 +1557,8 @@ class ExceptionReporterFilterTests(
"SECRET_KEY_FALLBACKS", "SECRET_KEY_FALLBACKS",
"PASSWORD", "PASSWORD",
"API_KEY", "API_KEY",
"AUTH_TOKEN", "SOME_TOKEN",
"MY_AUTH",
] ]
def test_non_sensitive_request(self): def test_non_sensitive_request(self):
@ -1885,6 +1886,7 @@ class ExceptionReporterFilterTests(
"PASSWORD": "super secret", "PASSWORD": "super secret",
"SECRET_VALUE": "super secret", "SECRET_VALUE": "super secret",
"SOME_TOKEN": "super secret", "SOME_TOKEN": "super secret",
"THE_AUTH": "super secret",
} }
request = self.rf.get("/", headers=headers) request = self.rf.get("/", headers=headers)
reporter_filter = SafeExceptionReporterFilter() reporter_filter = SafeExceptionReporterFilter()