Bug 50605 – don't log password in base_http.get_json()

Bug 50605 - don't log password in base_http.get_json()


Summary:	don't log password in base_http.get_json()

Status:	RESOLVED FIXED

Product:	Components
Classification:	Unclassified
Component:	udm-rest-api-client
Version:	unspecified
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Daniel Tröder
QA Contact:	Ole Schwiegert

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2019-12-06 10:41 CET by Daniel Tröder
Modified:	2019-12-06 19:52 CET (History)
CC List:	0 users

See Also:
What kind of report is it?:	Security Issue
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Daniel Tröder

2019-12-06 10:41:43 CET

base_http.get_json()n logs all arguments passed to the request method including the Basic Auth credentials.

Remove the password from the log output.

Comment 1 Daniel Tröder

2019-12-06 19:52:58 CET

The password of the UDM REST API connection is not logged anymore.
This is also tested.

[master eca4e9c] don't log UDM REST API user password

https://travis-ci.com/univention/python-udm-rest-api-client/builds/139803588
https://codecov.io/github/univention/python-udm-rest-api-client/commit/eca4e9c2d732a3afab6a4f7790953706aa35a515