openstack
/
python-glanceclient
Code Issues Proposed changes

Do not leak X-Auth-Token when logging curl requests 

We pass *encoded* headers to log_curl_request, but then compare them to
*unencoded* sensitive headers that must be redacted (basically comparing
bytes to strings). This means no header is ever redacted.

Store sensitive headers as bytes rather than strings to fix this issue.

Change-Id: I06785704750e8c4b23d1276514949655e6dcb7ab
Closes-Bug: #2051712
This commit is contained in:
Cyril Roelandt 2024-03-27 19:37:25 +01:00
parent 769dd2e78d
commit 28497adc33
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
glanceclient/common/utils.py
View File

@ -42,7 +42,10 @@ from glanceclient import exc
_memoized_property_lock = threading.Lock()
SENSITIVE_HEADERS = ('X-Auth-Token', )
# NOTE(cyril): Sensitive headers must be bytes, not strings, because when we
# compare them to actual headers in safe_header, headers have already been
# encoded.
SENSITIVE_HEADERS = (b'X-Auth-Token', )
REQUIRED_FIELDS_ON_DATA = ('disk_format', 'container_format')