Projet

Général

Profil

0001-errors-hide-credentials-in-urls-in-error-messages-34.patch

Lauréline Guérin, 10 octobre 2019 16:25

Télécharger (3,65 ko)

Voir les différences: 

Subject: [PATCH] errors: hide credentials in urls in error messages (#34793)


 passerelle/utils/log.py | 24 ++++++++++++++++++++++++
 tests/test_misc.py      | 34 +++++++++++++++++++++++++++++++---
 2 files changed, 55 insertions(+), 3 deletions(-)
 create mode 100644 passerelle/utils/log.py
passerelle/utils/log.py
1 
from copy import copy
2 
import re
3 

  		




  
  4
  
    
from django.utils.log import AdminEmailHandler as DjangoAdminEmailHandler

  		




  
  5
  
    
from django.utils.six.moves.urllib.parse import urlparse

  		




  
  6
  
    

  		




  
  7
  
    

  		




  
  8
  
    
class AdminEmailHandler(DjangoAdminEmailHandler):

  		




  
  9
  
    
    def emit(self, record):

  		




  
  10
  
    
        record = copy(record)

  		




  
  11
  
    
        msg = record.getMessage()

  		




  
  12
  
    

  		




  
  13
  
    
        # hide credentials in urls

  		




  
  14
  
    
        for url in re.findall(r'(https?://\S+)', msg):

  		




  
  15
  
    
            parsed = urlparse(url)

  		




  
  16
  
    
            if not parsed.username and not parsed.password:

  		




  
  17
  
    
                continue

  		




  
  18
  
    
            replaced = parsed._replace(netloc="{}:{}@{}".format('***', '***', parsed.hostname))

  		




  
  19
  
    
            msg = msg.replace(url, replaced.geturl())

  		




  
  20
  
    

  		




  
  21
  
    
        # replace record message

  		




  
  22
  
    
        record.msg = msg

  		




  
  23
  
    

  		




  
  24
  
    
        return super(AdminEmailHandler, self).emit(record)

  		












  

    
      tests/test_misc.py
    
  





  1
  1
  
    
import datetime

  		




  
  2
  
    
import logging

  		




  2
  3
  
    
import pytest

  		




  3
  4
  
    
from mock import patch

  		




  4
  5
  
    

  		




  ......




  7
  8
  
    
from passerelle.base.models import ResourceLog

  		




  8
  9
  
    
from passerelle.apps.opengis.models import OpenGIS

  		




  9
  10
  
    
from passerelle.apps.clicrdv.models import ClicRdv

  		




  
  11
  
    
from passerelle.utils.log import AdminEmailHandler

  		




  10
  12
  
    

  		




  11
  13
  
    

  		




  12
  14
  
    
def test_get_description_url_fields(db):

  		




  ......




  43
  45
  
    

  		




  44
  46
  
    
@pytest.fixture

  		




  45
  47
  
    
def email_handler():

  		




  46
  
  
    
    import logging

  		




  47
  
  
    
    from django.utils.log import AdminEmailHandler

  		




  48
  
  
    

  		




  49
  48
  
    
    root = logging.getLogger()

  		




  50
  49
  
    
    handler = AdminEmailHandler(include_html=True)

  		




  51
  50
  
    
    handler.level = logging.ERROR

  		




  ......




  88
  87
  
    
        assert len(mailoutbox) == 2

  		




  89
  88
  
    
        assert mailoutbox[0].to == ['admin@example.net']

  		




  90
  89
  
    
        assert mailoutbox[1].to == ['john.doe@example.net']

  		




  
  90
  
    

  		




  
  91
  
    

  		




  
  92
  
    
@pytest.mark.parametrize('error_msg, expected', [

  		




  
  93
  
    
    ('GET http://tcl.example.net/tclpassagearret (=> 502)',

  		




  
  94
  
    
     'GET http://tcl.example.net/tclpassagearret (=> 502)'),

  		




  
  95
  
    
    ('GET https://tcl.example.net/tclpassagearret (=> 502)',

  		




  
  96
  
    
     'GET https://tcl.example.net/tclpassagearret (=> 502)'),

  		




  
  97
  
    
    ('GET http://username:password@tcl.example.net/tclpassagearret (=> 502)',

  		




  
  98
  
    
     'GET http://***:***@tcl.example.net/tclpassagearret (=> 502)'),

  		




  
  99
  
    
    ('GET https://username:password@tcl.example.net/tclpassagearret (=> 502)',

  		




  
  100
  
    
     'GET https://***:***@tcl.example.net/tclpassagearret (=> 502)'),

  		




  
  101
  
    
])

  		




  
  102
  
    
def test_trace_emails_hide_credentials(settings, mailoutbox, error_msg, expected):

  		




  
  103
  
    
    logger = logging.getLogger('django')

  		




  
  104
  
    
    handler = AdminEmailHandler(include_html=True)

  		




  
  105
  
    

  		




  
  106
  
    
    settings.ADMINS = [('admin', 'admin@example.net')]

  		




  
  107
  
    

  		




  
  108
  
    
    record = logger.makeRecord(

  		




  
  109
  
    
        'name', logging.ERROR,

  		




  
  110
  
    
        'function', 'lno',

  		




  
  111
  
    
        error_msg,

  		




  
  112
  
    
        None, None)

  		




  
  113
  
    
    handler.emit(record)

  		




  
  114
  
    
    assert len(mailoutbox) == 1

  		




  
  115
  
    
    msg = mailoutbox[0]

  		




  
  116
  
    
    assert msg.to == ['admin@example.net']

  		




  
  117
  
    
    assert msg.subject == '[Django] ERROR: %s' % expected

  		




  
  118
  
    
    assert expected in msg.body

  		




  91
  
  
    
-