From 4eb756793b64cf153be4fbe0411da6e3e4f1279d Mon Sep 17 00:00:00 2001 From: Hasan Ramezani Date: Wed, 28 Oct 2020 14:21:53 +0100 Subject: Refs #28215 -- Marked auth credentials as sensitive variables. Co-authored-by: Collin Anderson --- tests/auth_tests/test_auth_backends.py | 47 ++++++++++++++++++++++++++++++++-- 1 file changed, 45 insertions(+), 2 deletions(-) (limited to 'tests') diff --git a/tests/auth_tests/test_auth_backends.py b/tests/auth_tests/test_auth_backends.py index b6aa1a2833..d01d0b6526 100644 --- a/tests/auth_tests/test_auth_backends.py +++ b/tests/auth_tests/test_auth_backends.py @@ -1,8 +1,10 @@ +import sys from datetime import date from unittest import mock from django.contrib.auth import ( - BACKEND_SESSION_KEY, SESSION_KEY, authenticate, get_user, signals, + BACKEND_SESSION_KEY, SESSION_KEY, _clean_credentials, authenticate, + get_user, signals, ) from django.contrib.auth.backends import BaseBackend, ModelBackend from django.contrib.auth.hashers import MD5PasswordHasher @@ -11,8 +13,10 @@ from django.contrib.contenttypes.models import ContentType from django.core.exceptions import ImproperlyConfigured, PermissionDenied from django.http import HttpRequest from django.test import ( - SimpleTestCase, TestCase, modify_settings, override_settings, + RequestFactory, SimpleTestCase, TestCase, modify_settings, + override_settings, ) +from django.views.debug import technical_500_response from django.views.decorators.debug import sensitive_variables from .models import ( @@ -633,6 +637,7 @@ class TypeErrorBackend: Always raises TypeError. """ + @sensitive_variables('password') def authenticate(self, request, username=None, password=None): raise TypeError @@ -654,12 +659,50 @@ class AuthenticateTests(TestCase): def setUpTestData(cls): cls.user1 = User.objects.create_user('test', 'test@example.com', 'test') + def setUp(self): + self.sensitive_password = 'mypassword' + @override_settings(AUTHENTICATION_BACKENDS=['auth_tests.test_auth_backends.TypeErrorBackend']) def test_type_error_raised(self): """A TypeError within a backend is propagated properly (#18171).""" with self.assertRaises(TypeError): authenticate(username='test', password='test') + @override_settings(AUTHENTICATION_BACKENDS=['auth_tests.test_auth_backends.TypeErrorBackend']) + def test_authenticate_sensitive_variables(self): + try: + authenticate(username='testusername', password=self.sensitive_password) + except TypeError: + exc_info = sys.exc_info() + rf = RequestFactory() + response = technical_500_response(rf.get('/'), *exc_info) + self.assertNotContains(response, self.sensitive_password, status_code=500) + self.assertContains(response, 'TypeErrorBackend', status_code=500) + self.assertContains( + response, + 'credentials' + '
'********************'
', + html=True, + status_code=500, + ) + + def test_clean_credentials_sensitive_variables(self): + try: + # Passing in a list to cause an exception + _clean_credentials([1, self.sensitive_password]) + except TypeError: + exc_info = sys.exc_info() + rf = RequestFactory() + response = technical_500_response(rf.get('/'), *exc_info) + self.assertNotContains(response, self.sensitive_password, status_code=500) + self.assertContains( + response, + 'credentials' + '
'********************'
', + html=True, + status_code=500, + ) + @override_settings(AUTHENTICATION_BACKENDS=( 'auth_tests.test_auth_backends.SkippedBackend', 'django.contrib.auth.backends.ModelBackend', -- cgit v1.3