zhmcclient / python-zhmcclient / test-4447

77%

Build Type

push

github

Committed by web-flow

Commit Message

Improved checking for sensitive properties in logs (#2118)

The following sensitive data is now blanked out that was not blanked out before:

In the HTTP operation logging:
  - "Create SSO Server Definition" operation:
    - `client-secret` request field - OIDC client secret for the SSO server

In the API call logging:
  - SSOServerDefinitionManager.create():
    - `client-secret` property - OIDC client secret for the SSO server

Note that the support for SSO server definitions is new and has not yet
been released. So this is not an externally documented fix.

Details:

* Changed the approach for blanking out sensitive properties in logs for
  API calls and return values: Instead of using the blanked_properties
  argument of the logged_api_call decorator to point to specific properties,
  the blanking out is now done when the string representation of the
  argument or return value has been created, by matching certain
  property names using a regexp in the repr() string of the arguments or
  return values.

  The blanked_properties argument in the logged_api_call decorator still
  exists in case it is needed in the future for additional properties, but
  it is not currently used.

* Changed the approach for blanking out sensitive properties in logs for
  HTTP requests and responses: Instead of checking for a set of specific
  sensitive property names in the dict representation of the request and
  response bodies, the sensitive properties are now detected by matching
  certain property names using a regexp in the JSON string of the body.

* In the test_logging.py unit test module, changed the use of .msg for
  accessing the expanded log message to using .getMessage(). It is not
  clear why that worked before, but getMessage() is the official way to
  get at the expanded log message.

* Improved performance in _log_http_request() and _log_http_response()
  by not executing the code when debug logging is disabled.

Signed-off-by: Andreas Maier <maiera@de.ibm.com>

Run Details

1825 of 2818 branches covered (64.76%)

Branch coverage included in aggregate %.

37 of 83 new or added lines in 10 files covered. (44.58%)

6 existing lines in 1 file now uncovered.

9474 of 11822 relevant lines covered (80.14%)

9.61 hits per line