edf2475413
* fix: harden API token handling against rate-limit tampering and plaintext logging - Make `allowed_rate_limit` read-only on APITokenSerializer so users can no longer raise their own API token rate limit via PATCH (GHSA-xfgr-2x3f-g2cf). - Stop persisting API keys in plaintext in APITokenLogMiddleware: store a SHA-256 hash as the token identifier and redact sensitive request headers (X-Api-Key, Authorization, Cookie) before logging (GHSA-r5p8-cj3q-38cc). * refactor: remove MongoDB log sink and add per-log-type retention Logs are now written to and cleared from PostgreSQL only; MongoDB is no longer used as a log sink or archive. - Drop the MongoDB write/archival paths from the API request logger, the webhook log writer, and the cleanup tasks; Postgres is the sole sink. - Cleanup tasks now hard-delete expired rows in batches via `all_objects` (rows are removed immediately, not soft-deleted). - Add env-backed, per-log-type retention settings: API activity logs (API_ACTIVITY_LOG_RETENTION_DAYS, default 14), webhook logs (WEBHOOK_LOG_RETENTION_DAYS, default 14), email logs (EMAIL_LOG_RETENTION_DAYS, default 7). HARD_DELETE_AFTER_DAYS no longer drives any log cleanup. - Delete settings/mongo.py, remove MONGO_DB_* settings and the plane.mongo loggers, and drop the pymongo dependency. * chore: gitignore local advisories.md notes file * fix: use keyed HMAC-SHA256 for API token log identifier Address CodeQL "weak hashing of sensitive data" by hashing the API key with a SECRET_KEY-keyed HMAC instead of a bare SHA-256. The identifier is a non-reversible tokenization of a high-entropy key (not password storage); keying it also prevents precomputing the digest from a known key value. * chore: address review feedback on log cleanup and request logging - process_logs accepts extra kwargs so jobs enqueued by an older release (with a mongo_log arg) don't fail during a rolling deploy. - Log-cleanup batch delete failures are logged and skipped rather than aborting the run, so a single bad batch can't block the rest. - Extend logger middleware test to assert Authorization and Cookie headers are redacted; add a test that a failing cleanup batch is swallowed. * fix: fall back to default when a log retention env value is invalid Negative (or unparseable) retention values would compute a future cutoff and delete every log row. The retention settings now fall back to their defaults in that case via a shared `_retention_days` helper.
79 lines
2.9 KiB
Python
79 lines
2.9 KiB
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
"""
|
|
Unit tests for APITokenLogMiddleware.
|
|
|
|
Covers the credential-hygiene guarantees of the external API request logger:
|
|
- the raw API key is never persisted (a non-reversible hash is stored instead)
|
|
- sensitive request headers are redacted before being logged
|
|
"""
|
|
|
|
import hashlib
|
|
import hmac
|
|
from unittest.mock import Mock, patch
|
|
|
|
import pytest
|
|
from django.conf import settings
|
|
from django.contrib.auth.models import AnonymousUser
|
|
from django.http import HttpResponse
|
|
from django.test import RequestFactory
|
|
|
|
from plane.middleware.logger import APITokenLogMiddleware
|
|
|
|
|
|
@pytest.fixture
|
|
def request_factory():
|
|
return RequestFactory()
|
|
|
|
|
|
@pytest.fixture
|
|
def middleware():
|
|
return APITokenLogMiddleware(Mock(return_value=HttpResponse(b"{}")))
|
|
|
|
|
|
@pytest.mark.unit
|
|
class TestAPITokenLogMiddleware:
|
|
API_KEY = "plane_api_supersecretvalue"
|
|
AUTHORIZATION = "Bearer secret-bearer-token"
|
|
COOKIE = "sessionid=secret-session-value"
|
|
|
|
def _captured_log_data(self, middleware, request_factory):
|
|
request = request_factory.get(
|
|
"/api/v1/workspaces/",
|
|
HTTP_X_API_KEY=self.API_KEY,
|
|
HTTP_AUTHORIZATION=self.AUTHORIZATION,
|
|
HTTP_COOKIE=self.COOKIE,
|
|
)
|
|
request.user = AnonymousUser()
|
|
response = HttpResponse(b"{}")
|
|
with patch("plane.middleware.logger.process_logs") as process_logs:
|
|
middleware.process_request(request, response, request_body=b"")
|
|
assert process_logs.delay.called
|
|
return process_logs.delay.call_args.kwargs["log_data"]
|
|
|
|
def test_token_identifier_is_hashed_not_plaintext(self, middleware, request_factory):
|
|
log_data = self._captured_log_data(middleware, request_factory)
|
|
|
|
expected_hash = hmac.new(
|
|
settings.SECRET_KEY.encode(), self.API_KEY.encode(), hashlib.sha256
|
|
).hexdigest()
|
|
assert log_data["token_identifier"] == expected_hash
|
|
assert self.API_KEY not in log_data["token_identifier"]
|
|
|
|
def test_sensitive_headers_are_redacted(self, middleware, request_factory):
|
|
log_data = self._captured_log_data(middleware, request_factory)
|
|
|
|
# None of the sensitive header values may appear in the logged headers.
|
|
assert self.API_KEY not in log_data["headers"]
|
|
assert self.AUTHORIZATION not in log_data["headers"]
|
|
assert self.COOKIE not in log_data["headers"]
|
|
assert "[REDACTED]" in log_data["headers"]
|
|
|
|
def test_no_log_without_api_key(self, middleware, request_factory):
|
|
request = request_factory.get("/api/v1/workspaces/")
|
|
request.user = AnonymousUser()
|
|
with patch("plane.middleware.logger.process_logs") as process_logs:
|
|
middleware.process_request(request, HttpResponse(b"{}"), request_body=b"")
|
|
assert not process_logs.delay.called
|