status-im/PyGithub
1
0
Fork 0
mirror of https://github.com/status-im/PyGithub.git synced 2026-08-31 19:01:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Do not transform requestHeaders when logging (#1965)

Browse Source 
Requester.__log() sanitizes the headers of the request so that
authentication details are not logged, but this has the side effect of
meaning that future requests that use the same Requester object will
fail. Usually, this is perfectly fine, since almost every method will
only make one request -- where this falls down is when we make another
after a redirect. Make a copy of the requestHeaders, and sanitize those.

Fixes #1959
This commit is contained in:
Steve Kowalik
2021-06-02 15:00:00 +10:00
committed by GitHub
parent ed7d0fe94f
commit 1265747e99
2 changed files with 22 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
github/Requester.py
+6 -5
View File
@@ -629,17 +629,18 @@ class Requester:
if self.__logger is None:
self.__logger = logging.getLogger(__name__)
if self.__logger.isEnabledFor(logging.DEBUG):
headersForRequest = requestHeaders.copy()
if "Authorization" in requestHeaders:
if requestHeaders["Authorization"].startswith("Basic"):
requestHeaders[
headersForRequest[
"Authorization"
] = "Basic (login and password removed)"
elif requestHeaders["Authorization"].startswith("token"):
requestHeaders["Authorization"] = "token (oauth token removed)"
headersForRequest["Authorization"] = "token (oauth token removed)"
elif requestHeaders["Authorization"].startswith("Bearer"):
requestHeaders["Authorization"] = "Bearer (jwt removed)"
headersForRequest["Authorization"] = "Bearer (jwt removed)"
else: # pragma no cover (Cannot happen, but could if we add an authentication method => be prepared)
requestHeaders[
headersForRequest[
"Authorization"
] = "(unknown auth removed)" # pragma no cover (Cannot happen, but could if we add an authentication method => be prepared)
self.__logger.debug(
@@ -648,7 +649,7 @@ class Requester:
self.__scheme,
self.__hostname,
url,
requestHeaders,
headersForRequest,
input,
status,
responseHeaders,