[Django] #31942: SafeExceptionReporterFilter does not recurse into dictionaries with non-string keys

5 views
Skip to first unread message

Django

unread,
Aug 25, 2020, 8:20:22 AM8/25/20
to django-...@googlegroups.com
#31942: SafeExceptionReporterFilter does not recurse into dictionaries with non-
string keys
-------------------------------------------+------------------------
Reporter: Jeremy Lainé | Owner: (none)
Type: Uncategorized | Status: new
Component: Error reporting | Version: 3.1
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------------+------------------------
SafeExceptionReporterFilter has provisions for recursively cleaning
settings by descending into lists / tuples / dictionaries - which is
great! However, recursing on dictionaries only works if the keys of the
dictionary are strings.

For instance it will fail to sanitize the following example:

`SOME_SETTING = {1: {'login': 'cooper', 'password': 'secret'}}`

The reason for this is that `cleanse_setting` starts by trying to apply a
the `hidden_settings` regex to the key before attempting to recurse into
the value:

https://github.com/django/django/blob/0b0658111cba538b91072b9a133fd5545f3f46d1/django/views/debug.py#L94

--
Ticket URL: <https://code.djangoproject.com/ticket/31942>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

Django

unread,
Aug 25, 2020, 12:14:36 PM8/25/20
to django-...@googlegroups.com
#31942: SafeExceptionReporterFilter does not recurse into dictionaries with non-
string keys
---------------------------------+----------------------------------------
Reporter: Jeremy Lainé | Owner: Jeremy Lainé
Type: Uncategorized | Status: assigned

Component: Error reporting | Version: 3.1
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+----------------------------------------
Changes (by Jeremy Lainé):

* owner: (none) => Jeremy Lainé
* status: new => assigned
* has_patch: 0 => 1


Comment:

Here is a PR for this issue https://github.com/django/django/pull/13347

--
Ticket URL: <https://code.djangoproject.com/ticket/31942#comment:1>

Django

unread,
Aug 26, 2020, 1:21:01 AM8/26/20
to django-...@googlegroups.com
#31942: SafeExceptionReporterFilter does not recurse into dictionaries with non-
string keys
-------------------------------------+-------------------------------------

Reporter: Jeremy Lainé | Owner: Jeremy
Type: | Lainé
Cleanup/optimization | Status: assigned

Component: Error reporting | Version: 3.1
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by felixxm):

* type: Uncategorized => Cleanup/optimization
* stage: Unreviewed => Accepted


Comment:

#31451

--
Ticket URL: <https://code.djangoproject.com/ticket/31942#comment:2>

Django

unread,
Aug 26, 2020, 1:53:10 AM8/26/20
to django-...@googlegroups.com
#31942: SafeExceptionReporterFilter does not recurse into dictionaries with non-
string keys
-------------------------------------+-------------------------------------
Reporter: Jeremy Lainé | Owner: Jeremy
Type: | Lainé
Cleanup/optimization | Status: assigned
Component: Error reporting | Version: 3.1
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1

Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by felixxm):

* needs_better_patch: 0 => 1


--
Ticket URL: <https://code.djangoproject.com/ticket/31942#comment:3>

Django

unread,
Aug 26, 2020, 6:13:15 AM8/26/20
to django-...@googlegroups.com
#31942: SafeExceptionReporterFilter does not recurse into dictionaries with non-
string keys
-------------------------------------+-------------------------------------
Reporter: Jeremy Lainé | Owner: Jeremy
Type: | Lainé
Cleanup/optimization | Status: assigned
Component: Error reporting | Version: 3.1
Severity: Normal | Resolution:
Keywords: | Triage Stage: Ready for
| checkin
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by felixxm):

* needs_better_patch: 1 => 0
* stage: Accepted => Ready for checkin


--
Ticket URL: <https://code.djangoproject.com/ticket/31942#comment:4>

Django

unread,
Aug 26, 2020, 6:30:49 AM8/26/20
to django-...@googlegroups.com
#31942: SafeExceptionReporterFilter does not recurse into dictionaries with non-
string keys
-------------------------------------+-------------------------------------
Reporter: Jeremy Lainé | Owner: Jeremy
Type: | Lainé
Cleanup/optimization | Status: closed

Component: Error reporting | Version: 3.1
Severity: Normal | Resolution: fixed

Keywords: | Triage Stage: Ready for
| checkin
Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Mariusz Felisiak <felisiak.mariusz@…>):

* status: assigned => closed
* resolution: => fixed


Comment:

In [changeset:"9c92924cd5d164701e2514e1c2d6574126bd7cc2" 9c92924c]:
{{{
#!CommitTicketReference repository=""
revision="9c92924cd5d164701e2514e1c2d6574126bd7cc2"
Fixed #31942 -- Made settings cleansing work with dictionary settings with
non-string keys.
}}}

--
Ticket URL: <https://code.djangoproject.com/ticket/31942#comment:5>

Reply all
Reply to author
Forward
0 new messages