Filter token data out of catch_errors middleware3.23.1

If an exception is caught by the catch_errors middleware the entire
request is dumped into the log including sensitive information like
tokens. Filter that information before outputting the failed request.

Closes-Bug: #1628031
Change-Id: I2563403993513c37751576223275350cac2e0937

1 files changed, 25 insertions, 0 deletions

diff --git a/oslo_middleware/tests/test_catch_errors.py b/oslo_middleware/tests/test_catch_errors.py
index 66351e5..7a06218 100644
--- a/oslo_middleware/tests/test_catch_errors.py
+++ b/oslo_middleware/tests/test_catch_errors.py
@@ -13,6 +13,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import fixtures
 import mock
 from oslotest import base as test_base
 import webob.dec
@@ -48,3 +49,27 @@ class CatchErrorsTest(test_base.BaseTestCase):
             self.assertEqual(1, log_exc.call_count)
             req_log = log_exc.call_args[0][1]
             self.assertIn('X-Auth-Token: *****', str(req_log))
+
+    def test_filter_tokens_from_log(self):
+        logger = self.useFixture(fixtures.FakeLogger(nuke_handlers=False))
+
+        @webob.dec.wsgify
+        def application(req):
+            raise Exception()
+
+        app = catch_errors.CatchErrors(application)
+        req = webob.Request.blank('/test',
+                                  text=u'test data',
+                                  method='POST',
+                                  headers={'X-Auth-Token': 'secret1',
+                                           'X-Service-Token': 'secret2',
+                                           'X-Other-Token': 'secret3'})
+        res = req.get_response(app)
+        self.assertEqual(500, res.status_int)
+
+        output = logger.output
+
+        self.assertIn('X-Auth-Token: *****', output)
+        self.assertIn('X-Service-Token: *****', output)
+        self.assertIn('X-Other-Token: *****', output)
+        self.assertIn('test data', output)