jazzband / django-silk

Silky smooth profiling for Django
MIT License
4.42k stars 333 forks source link

Authorization header is not masked (regression) #657

Open alextatarinov opened 1 year ago

alextatarinov commented 1 year ago

https://github.com/jazzband/django-silk/commit/bb4df5b1a842481df5069d738f98ba4773bb5600 Introduced a regression of https://github.com/jazzband/django-silk/issues/375. Although request.headers[KEY] lookup is case-insensitive, iterating over .items() yields header keys with the original letter case. The tests pass because they use a lowercased authorization header. The fix could be as simple as adding k.lower(). https://github.com/jazzband/django-silk/blob/274898fc8a728b0eed6c49f74e906e7be5d86cd8/silk/model_factory.py#L72-L74