Hide Django sensitive datas

[berkantaydin]

If use "sensitive_post_parameters" decorator in Django, running perfectly but raven send to sentry everything. Request Body have all datas (sensitive too). I fixed this for replace .

[coveralls]

Coverage decreased (-0%) when pulling dec0333 on berkantaydin:master into 2a1dd41 on getsentry:master.

[xordoquy]

Is there any reason you can't do that with a processor ?
Their goal is to filter out sensitive data.
Have a look at https://github.com/getsentry/raven-python/blob/master/raven/processors.py.

[berkantaydin]

No i have not any reason for this. I'm looking now. Sorry

[berkantaydin]

I tried do this but this for only Django. Because i need sensitive_post_parameters from django decorators. But processors.py is general for Django, flask and more.

[dcramer]

we could change default Django processors, but in the end this is really specific, so ideally we'd be able to actually support sensitive_post_parameters (and not just all)

I'm actually OK with this being only available in the Django client as well, but I'd love to see it correctly support the sensitive params

[berkantaydin]

We are use Django 1.4
We will use newest raven our productions. This fix is very important for us. Do you will accept for pull or i must update for better solution? Thank you for quick reply and your interest.

Added note: My Message not offensive. Sorry for my English. I want to help for better raven. I like it.

[xordoquy]

Indeed processors aren't enough in your case, I'm sorry I missed the point.
I'm not against the general idea but the implementation needs to be more generic and it's probably going to take a bit of time.
In the meanwhile, you should be able to override the raven default django client.

[berkantaydin]

I modified the django client in raven because sensitive_post_parameters (https://docs.djangoproject.com/en/1.4/howto/error-reporting/#sensitive_post_parameters) are built in django 1.4 and in new versions by default decorators. I check whether sensitive_post_parameters exist in old versions of django. (older than 1.4) this is the most generic situation I have ever known. Do you have any suggestions to make my code effective? Thanks.

[xordoquy]

I need to write some test cases to see how raven already behave and figure what the next steps are.

[berkantaydin]

Thank you.

[coveralls]

Coverage decreased (-0%) when pulling 19109f8 on berkantaydin:master into 2a1dd41 on getsentry:master.

[coveralls]

Coverage decreased (-0%) when pulling 193e91c on berkantaydin:master into 2a1dd41 on getsentry:master.

[berkantaydin]

Why i am added new lines ?

Because, sensitive post parameters decorators, usable with non-params or with params. My previous (first) commit for "non-params type" and hide everything -if developer want-

But if developer only masking few post variable "like credit-numer, username, password" must be use with params. I fix this. Sorry for less commit. Commit last for more performance.

We are waiting for news. I wish you success in your work

[dcramer]

This looks pretty good. I'd like to get some tests for this though as I dont feel like manually QAing a patch

[berkantaydin]

Please wait, i will change some import because we have "probably" unicode error. I have to use django's urllib. I will fix this. Sorry again. I will fix and push. Our codereview team said need more test.

[xordoquy]

urlparse doesn't exists in python3 out of the box. See https://github.com/getsentry/raven-python/blob/master/raven/utils/compat.py#L36 about.
The urlencode is likely not to work under python3 too. If it doesn't you'll need to add an entry in the compat to import it.

If you fix those two points, you'll be able to see any unicode encode/decode error in the tests.

[berkantaydin]

I will fix urlparse with _urlparse (in raven compat) and urlencode with "from django.utils.http import urlencode"

[coveralls]

Coverage decreased (-0%) when pulling 9c0595c on berkantaydin:master into 2a1dd41 on getsentry:master.

[berkantaydin]

system working good but "we have to" use processors. Because sensitive datas still can be readable with other methods. This pull request NOT OK! :( Sorry. I will work on this.

[xordoquy]

I'll try to have a look at that one this week end

[berkantaydin]

Ok now.

[dcramer]

we can just require the use of the raven middleware for this, and install a custom Django processor.

See raven.contrib.django.middleware.SentryMiddleware

It gives us access to the request object, and then we can have a SensitiveDataProcessor or something that we add to the default processors (for Django client) which applies this

[berkantaydin]

We are resolve this with Processor. Sorry your time.

[brendancustommade]

@berkantaydin can you please share how you accomplished this with processors? I am currently having the same issue and would love to solve. thanks

[berkantaydin]

You can use the Processor.

http://raven.readthedocs.org/en/latest/config/

look at processor tabs;

You write own processor and use like this

processors = (
'raven.processors.SanitizePasswordsProcessor',
)