#31451: Settings are cleaned insufficiently
------------------------------------------------+------------------------
Reporter: Markus Holtermann | Owner: (none)
Type: Cleanup/optimization | Status: new
Component: Error reporting | Version: master
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
------------------------------------------------+------------------------
Posting publicly after checking with the rest of the security team.
I just ran into a case where
`django.views.debug.SafeExceptionReporterFilter.get_safe_settings()` would
return several un-cleansed values. Looking at `cleanse_setting()` I
realized that we
[https://github.com/django/django/blob/f5ede1cb6da473166d22c04dcbd8240e2a0f223d/django/views/debug.py#L91-L92
only take care of `dict`s] but don't take other types of iterables into
account but
[https://github.com/django/django/blob/f5ede1cb6da473166d22c04dcbd8240e2a0f223d/django/views/debug.py#L93-L94
return them as-is].
Example:
In my settings.py I have this:
{{{#!python
MY_SETTING = {
"foo": "value",
"secret": "value",
"token": "value",
"something": [
{"foo": "value"},
{"secret": "value"},
{"token": "value"},
],
"else": [
[
{"foo": "value"},
{"secret": "value"},
{"token": "value"},
],
[
{"foo": "value"},
{"secret": "value"},
{"token": "value"},
],
]
}
}}}
On Django 3.0 and below:
{{{#!python
>>> import pprint
>>> from django.views.debug import get_safe_settings
>>> pprint.pprint(get_safe_settings()["MY_SETTING"])
{'else': [[{'foo': 'value'}, {'secret': 'value'}, {'token': 'value'}],
[{'foo': 'value'}, {'secret': 'value'}, {'token': 'value'}]],
'foo': 'value',
'secret': '********************',
'something': [{'foo': 'value'}, {'secret': 'value'}, {'token': 'value'}],
'token': '********************'}
}}}
On Django 3.1 and up:
{{{#!python
>>> from django.views.debug import SafeExceptionReporterFilter
>>> import pprint
>>>
pprint.pprint(SafeExceptionReporterFilter().get_safe_settings()["MY_SETTING"])
{'else': [[{'foo': 'value'}, {'secret': 'value'}, {'token': 'value'}],
[{'foo': 'value'}, {'secret': 'value'}, {'token': 'value'}]],
'foo': 'value',
'secret': '********************',
'something': [{'foo': 'value'}, {'secret': 'value'}, {'token': 'value'}],
'token': '********************'}
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/31451>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/050.f6f3b5d9e2d50ef024ebba5be178d79b%40djangoproject.com.
