mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #23004 -- Added request.META filtering to SafeExceptionReporterFilter.

Browse Source 
Co-authored-by: Ryan Castner <castner.rr@gmail.com>
This commit is contained in:
Carlton Gibson
2020-01-09 11:37:19 +01:00
committed by Mariusz Felisiak
parent 581ba5a948
commit e2d9d66a22
6 changed files with 40 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
tests/view_tests/tests/test_debug.py
View File

@@ -1224,6 +1224,24 @@ class ExceptionReporterFilterTests(ExceptionReportTestMixin, LoggingCaptureMixin
{'login': 'cooper', 'password': reporter_filter.cleansed_substitute},
)
def test_request_meta_filtering(self):
request = self.rf.get('/', HTTP_SECRET_HEADER='super_secret')
reporter_filter = SafeExceptionReporterFilter()
self.assertEqual(
reporter_filter.get_safe_request_meta(request)['HTTP_SECRET_HEADER'],
reporter_filter.cleansed_substitute,
)
def test_exception_report_uses_meta_filtering(self):
response = self.client.get('/raises500/', HTTP_SECRET_HEADER='super_secret')
self.assertNotIn(b'super_secret', response.content)
response = self.client.get(
'/raises500/',
HTTP_SECRET_HEADER='super_secret',
HTTP_X_REQUESTED_WITH='XMLHttpRequest',
)
self.assertNotIn(b'super_secret', response.content)
class CustomExceptionReporterFilter(SafeExceptionReporterFilter):
cleansed_substitute = 'XXXXXXXXXXXXXXXXXXXX'