NeoAnd/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2025-07-16 12:12:53 -06:00
Code Issues Actions 11 Packages Projects Releases Wiki Activity

Fixes #19265: Strip linebreaks from URLs for logging

Browse Source
This commit is contained in:
Jeremy Stretch 2025-04-22 12:34:11 -04:00
parent 13ddd5fd20
commit 1850c21714
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
netbox/account/views.py
View File

@ -28,6 +28,7 @@ from netbox.config import get_config
from netbox.views import generic from netbox.views import generic
from users import forms, tables from users import forms, tables
from users.models import UserConfig from users.models import UserConfig
from utilities.string import remove_linebreaks
from utilities.views import register_model_view from utilities.views import register_model_view
@ -133,7 +134,8 @@ class LoginView(View):
return response return response
else: else:
logger.debug(f"Login form validation failed for username: {form['username'].value()}") username = form['username'].value()
logger.debug(f"Login form validation failed for username: {remove_linebreaks(username)}")
return render(request, self.template_name, { return render(request, self.template_name, {
'form': form, 'form': form,
@ -145,10 +147,10 @@ class LoginView(View):
redirect_url = data.get('next', settings.LOGIN_REDIRECT_URL) redirect_url = data.get('next', settings.LOGIN_REDIRECT_URL)
if redirect_url and url_has_allowed_host_and_scheme(redirect_url, allowed_hosts=None): if redirect_url and url_has_allowed_host_and_scheme(redirect_url, allowed_hosts=None):
logger.debug(f"Redirecting user to {redirect_url}") logger.debug(f"Redirecting user to {remove_linebreaks(redirect_url)}")
else: else:
if redirect_url: if redirect_url:
logger.warning(f"Ignoring unsafe 'next' URL passed to login form: {redirect_url}") logger.warning(f"Ignoring unsafe 'next' URL passed to login form: {remove_linebreaks(redirect_url)}")
redirect_url = reverse('home') redirect_url = reverse('home')
return HttpResponseRedirect(redirect_url) return HttpResponseRedirect(redirect_url)

8
netbox/utilities/string.py
View File

@ -1,9 +1,17 @@
__all__ = ( __all__ = (
'remove_linebreaks',
'title', 'title',
'trailing_slash', 'trailing_slash',
) )
def remove_linebreaks(value):
"""
Remove all line breaks from a string and return the result. Useful for log sanitization purposes.
"""
return value.replace('\n', '').replace('\r', '')
def title(value): def title(value):
""" """
Improved implementation of str.title(); retains all existing uppercase letters. Improved implementation of str.title(); retains all existing uppercase letters.