Fixed #21098 -- Applied sensitive_post_parameters to MultiValueDict

Thanks simonpercivall for the report and bmispelon for the review.

2 files changed, 28 insertions, 1 deletions

diff --git a/tests/view_tests/tests/test_debug.py b/tests/view_tests/tests/test_debug.py
index 618e2175a5..c29b5520d5 100644
--- a/tests/view_tests/tests/test_debug.py
+++ b/tests/view_tests/tests/test_debug.py
@@ -24,7 +24,8 @@ from django.views.debug import ExceptionReporter
 from .. import BrokenException, except_args
 from ..views import (sensitive_view, non_sensitive_view, paranoid_view,
     custom_exception_reporter_filter_view, sensitive_method_view,
-    sensitive_args_function_caller, sensitive_kwargs_function_caller)
+    sensitive_args_function_caller, sensitive_kwargs_function_caller,
+    multivalue_dict_key_error)
 
 
 @override_settings(DEBUG=True, TEMPLATE_DEBUG=True)
@@ -511,6 +512,19 @@ class ExceptionReporterFilterTests(TestCase, ExceptionReportTestMixin):
             self.verify_paranoid_response(paranoid_view)
             self.verify_paranoid_email(paranoid_view)
 
+    def test_multivalue_dict_key_error(self):
+        """
+        #21098 -- Ensure that sensitive POST parameters cannot be seen in the
+        error reports for if request.POST['nonexistent_key'] throws an error.
+        """
+        with self.settings(DEBUG=True):
+            self.verify_unsafe_response(multivalue_dict_key_error)
+            self.verify_unsafe_email(multivalue_dict_key_error)
+
+        with self.settings(DEBUG=False):
+            self.verify_safe_response(multivalue_dict_key_error)
+            self.verify_safe_email(multivalue_dict_key_error)
+
     def test_custom_exception_reporter_filter(self):
         """
         Ensure that it's possible to assign an exception reporter filter to
diff --git a/tests/view_tests/views.py b/tests/view_tests/views.py
index 814931a717..6e8fa7f813 100644
--- a/tests/view_tests/views.py
+++ b/tests/view_tests/views.py
@@ -289,3 +289,16 @@ class Klass(object):
 
 def sensitive_method_view(request):
     return Klass().method(request)
+
+
+@sensitive_variables('sauce')
+@sensitive_post_parameters('bacon-key', 'sausage-key')
+def multivalue_dict_key_error(request):
+    cooked_eggs = ''.join(['s', 'c', 'r', 'a', 'm', 'b', 'l', 'e', 'd'])
+    sauce = ''.join(['w', 'o', 'r', 'c', 'e', 's', 't', 'e', 'r', 's', 'h', 'i', 'r', 'e'])
+    try:
+        request.POST['bar']
+    except Exception:
+        exc_info = sys.exc_info()
+        send_log(request, exc_info)
+        return technical_500_response(request, *exc_info)