Ticket #18923: 0001-Ticket-18923-Add-test-for-ensitive_post_parameters.patch

django/test/testcases.py

@@ -12 +12 @@
 except ImportError:     # Python 2
     from urlparse import urlsplit, urlunsplit
 from xml.dom.minidom import parseString, Node
+from lxml import etree
 import select
 import socket
 import threading
@@ -625 +626 @@
             msg_prefix + "Response redirected to '%s', expected '%s'" %
                 (url, expected_url))
 
+
+    def parseHtml(self, body, encoding="utf-8"):
+        "Get XML Element"
+        content = re.sub(".*?<", "<", body, 1, re.DOTALL)
+        reader = etree.HTMLParser(recover=True, encoding=encoding)
+        return etree.fromstring(content, reader)
+
+
     def assertContains(self, response, text, count=None, status_code=200,
                        msg_prefix='', html=False):
         """

tests/regressiontests/views/tests/debug.py

@@ -10 +10 @@
 from django.test.utils import (setup_test_template_loader,
                                restore_template_loaders)
 from django.core.urlresolvers import reverse
-from django.views.debug import ExceptionReporter
+from django.views.debug import ExceptionReporter, CLEANSED_SUBSTITUTE
 from django.core import mail
 
 from .. import BrokenException, except_args
 from ..views import (sensitive_view, non_sensitive_view, paranoid_view,
-    custom_exception_reporter_filter_view, sensitive_method_view)
+    custom_exception_reporter_filter_view, sensitive_method_view,
+    sensitive_post_method_view)
 
 
 class DebugViewTests(TestCase):
@@ -237 +238 @@
                       'hash-brown-key': 'hash-brown-value',
                       'bacon-key': 'bacon-value',}
 
+    unsafe_post_data = (
+        ('username', repr(u'myname')),
+        ('password', repr(u'secret')),
+        ('secret-key', repr(u'identifier')),
+    )
+    safe_post_data = (
+        ('username', repr(u'myname')),
+        ('password', repr(CLEANSED_SUBSTITUTE)),
+        ('secret-key', repr(CLEANSED_SUBSTITUTE)),
+    )
+
+
     def verify_unsafe_response(self, view, check_for_vars=True,
                                check_for_POST_params=True):
         """
@@ -370 +383 @@
                 self.assertNotIn(v, email.body)
 
 
+    def _get_xml_doc_from_response(self, response):
+        "Get XML from response"
+        if (hasattr(response, 'render') and callable(response.render)
+            and not response.is_rendered):
+            response.render()
+
+        content = response.content.decode(response._charset)
+        return self.parseHtml(content, response._charset)
+
+
+    def _get_xml_doc(self, view):
+        "Make response from view"
+        request = self.rf.post('/some_url/', self.breakfast_data)
+        response = view(request)
+        return self._get_xml_doc_from_response(response)
+
+
+    def _get_post_element(self, view):
+        """
+        Parse table after:
+
+        <h3 id="post-info">POST</h3>
+        <table class="req">
+        """
+        xmldoc = self._get_xml_doc(view)
+        return xmldoc.xpath("//h3[@id='post-info']/following-sibling::table[1]")[0]
+
+
+    def _verify_post_response(self, post, post_data):
+        """
+        Check POST values:
+
+          <tr>
+            <td>username</td>
+            <td class="code"><pre>u&#39;myname&#39;</pre></td>
+          </tr>
+
+          <tr>
+            <td>password</td>
+            <td class="code"><pre>u&#39;********************&#39;</pre></td>
+          </tr>
+        """
+        for name, value in post_data:
+            text = post.xpath("//td[text()='%s']/following-sibling::td/pre" % name)[0].text
+            self.assertEqual(value, text)
+
+
+    def verify_unsafe_post_response(self, view):
+        """
+        Asserts that potentially sensitive info are displayed in the response.
+        """
+        return self._verify_post_response(self._get_post_element(view),
+                                          self.unsafe_post_data)
+
+
+    def verify_safe_post_response(self, view):
+        """
+        Asserts that certain sensitive info are not displayed in the response.
+        """
+        return self._verify_post_response(self._get_post_element(view),
+                                          self.safe_post_data)
+
+
+    def verify_unsafe_post_email(self, view):
+        """
+        Asserts that potentially sensitive info are displayed in the email report.
+        """
+        with self.settings(ADMINS=(('Admin', 'admin@fattie-breakie.com'),)):
+            mail.outbox = [] # Empty outbox
+            request = self.rf.post('/some_url/', self.breakfast_data)
+            response = view(request)
+            self.assertEqual(len(mail.outbox), 1)
+            email = mail.outbox[0]
+            self._verify_post_response(self._get_xml_doc_from_response(response),
+                                       self.unsafe_post_data)
+
+
+    def verify_safe_post_email(self, view):
+        """
+        Asserts that certain sensitive info are not displayed in the email report.
+        """
+        with self.settings(ADMINS=(('Admin', 'admin@fattie-breakie.com'),)):
+            mail.outbox = [] # Empty outbox
+            request = self.rf.post('/some_url/', self.breakfast_data)
+            response = view(request)
+            self.assertEqual(len(mail.outbox), 1)
+            email = mail.outbox[0]
+            self._verify_post_response(self._get_xml_doc_from_response(response),
+                                       self.safe_post_data)
+
+
+
 class ExceptionReporterFilterTests(TestCase, ExceptionReportTestMixin):
     """
     Ensure that sensitive information can be filtered out of error reports.
@@ -440 +545 @@
                                         check_for_POST_params=False)
             self.verify_unsafe_email(sensitive_method_view,
                                      check_for_POST_params=False)
+            self.verify_unsafe_post_response(sensitive_post_method_view)
+            self.verify_unsafe_post_email(sensitive_post_method_view)
+
 
         with self.settings(DEBUG=False):
             self.verify_safe_response(sensitive_method_view,
                                       check_for_POST_params=False)
             self.verify_safe_email(sensitive_method_view,
                                    check_for_POST_params=False)
+            self.verify_safe_post_response(sensitive_post_method_view)
+            self.verify_safe_post_email(sensitive_post_method_view)
 
 
 class AjaxResponseExceptionReporterFilter(TestCase, ExceptionReportTestMixin):

tests/regressiontests/views/views.py

@@ -226 +226 @@
             send_log(request, exc_info)
             return technical_500_response(request, *exc_info)
 
+    @sensitive_post_parameters("password", "secret-key")
+    def method_post(self, request):
+        request.method = 'POST'
+        request.POST._mutable = True
+        request.POST["username"] = ''.join(('m', 'y', 'n', 'a', 'm', 'e'))
+        request.POST["password"] = ''.join(('s', 'e', 'c', 'r', 'e', 't'))
+        request.POST["secret-key"] = ''.join(('i', 'd', 'e', 'n', 't', 'i', 'f', 'i', 'e', 'r'))
+        request.POST._mutable = False
+        try:
+            raise Exception
+        except Exception:
+            exc_info = sys.exc_info()
+            send_log(request, exc_info)
+            return technical_500_response(request, *exc_info)
+
+
 def sensitive_method_view(request):
-    return Klass().method(request)
- No newline at end of file
+    return Klass().method(request)
+
+def sensitive_post_method_view(request):
+    return Klass().method_post(request)