Browse Source

[config] Escape passwords in URLs for dump_config (#2753)

Igor Khrol 2 years ago
parent
commit
fea91a9a98
2 changed files with 15 additions and 0 deletions
  1. 2 0
      desktop/core/src/desktop/api2.py
  2. 13 0
      desktop/core/src/desktop/api2_tests.py

+ 2 - 0
desktop/core/src/desktop/api2.py

@@ -20,6 +20,7 @@ standard_library.install_aliases()
 from builtins import map
 from builtins import map
 import logging
 import logging
 import os
 import os
+import re
 import json
 import json
 import sys
 import sys
 import tempfile
 import tempfile
@@ -148,6 +149,7 @@ def get_hue_config(request):
           conf['value'] = str(module.get_raw())
           conf['value'] = str(module.get_raw())
         else:
         else:
           conf['value'] = str(module.get_raw()).decode('utf-8', 'replace')
           conf['value'] = str(module.get_raw()).decode('utf-8', 'replace')
+        conf['value'] = re.sub('(.*)://(.*):(.*)@(.*)', r'\1://\2:**********@\4', conf['value'])
       attrs.append(conf)
       attrs.append(conf)
 
 
     return attrs
     return attrs

+ 13 - 0
desktop/core/src/desktop/api2_tests.py

@@ -189,6 +189,19 @@ class TestApi2(object):
     assert_true(len(response.content) < len(private_response.content))
     assert_true(len(response.content) < len(private_response.content))
 
 
 
 
+  def test_url_password_hiding(self):
+    client = make_logged_in_client(username="api2_superuser", groupname="default", recreate=True, is_superuser=True)
+    user = User.objects.get(username="api2_superuser")
+
+    data_to_escape = b"protocol://user:very_secret_password@host:1234/some/url"
+    clear = HIVE_SERVER_HOST.set_for_testing(data_to_escape)
+    try:
+      response = client.get('/desktop/api2/get_hue_config', data={})
+      assert_true(b"protocol://user:**********@host:1234/some/url" in response.content, response.content)
+    finally:
+      clear()
+
+
   def test_get_config(self):
   def test_get_config(self):
     response = self.client.get('/desktop/api2/get_config')
     response = self.client.get('/desktop/api2/get_config')