openstack/deb-cinder
Code Issues Proposed changes

Sync latest strutils from oslo-incubator

Browse Source 
We have had a request from Tristan Cacqueray to pull in the latest
strutils.  The request is driven by a need to get improvements in
place that make strutils.mask_password more secure.

-------------------------------------

Head of oslo-incubator:
commit 80a08a413fb0f23a056eca2d273b167f0a09bab6
Merge: 83c4098 d73f3b1
Author: Jenkins <jenkins@review.openstack.org>
Date:   Mon Aug 25 14:32:36 2014 +0000

    Merge "Remove unused/mutable default args"

--------------------------------------

This sync pulls in the following change:

66142c34 - Make strutils.mask_password more secure

--------------------------------------

Change-Id: Ie51d316a30bed40996db6cd860dbb9cb173e5ac6
Partial-bug: 1345233
This commit is contained in:
Jay S. Bryant
2014-08-26 11:24:54 -05:00
parent 296a32c169
commit beca4db62f
1 changed files with 30 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
cinder/openstack/common/strutils.py
View File

@@ -50,26 +50,37 @@ SLUGIFY_STRIP_RE = re.compile(r"[^\w\s-]")
SLUGIFY_HYPHENATE_RE = re.compile(r"[-\s]+") SLUGIFY_HYPHENATE_RE = re.compile(r"[-\s]+")
# NOTE(flaper87): The following 3 globals are used by `mask_password` # NOTE(flaper87): The following globals are used by `mask_password`
_SANITIZE_KEYS = ['adminPass', 'admin_pass', 'password', 'admin_password'] _SANITIZE_KEYS = ['adminPass', 'admin_pass', 'password', 'admin_password']
# NOTE(ldbragst): Let's build a list of regex objects using the list of # NOTE(ldbragst): Let's build a list of regex objects using the list of
# _SANITIZE_KEYS we already have. This way, we only have to add the new key # _SANITIZE_KEYS we already have. This way, we only have to add the new key
# to the list of _SANITIZE_KEYS and we can generate regular expressions # to the list of _SANITIZE_KEYS and we can generate regular expressions
# for XML and JSON automatically. # for XML and JSON automatically.
_SANITIZE_PATTERNS = [] _SANITIZE_PATTERNS_2 = []
_FORMAT_PATTERNS = [r'(%(key)s\s*[=]\s*[\"\']).*?([\"\'])', _SANITIZE_PATTERNS_1 = []
r'(<%(key)s>).*?(</%(key)s>)',
r'([\"\']%(key)s[\"\']\s*:\s*[\"\']).*?([\"\'])', # NOTE(amrith): Some regular expressions have only one parameter, some
r'([\'"].*?%(key)s[\'"]\s*:\s*u?[\'"]).*?([\'"])', # have two parameters. Use different lists of patterns here.
r'([\'"].*?%(key)s[\'"]\s*,\s*\'--?[A-z]+\'\s*,\s*u?[\'"])' _FORMAT_PATTERNS_1 = [r'(%(key)s\s*[=]\s*)[^\s^\'^\"]+']
'.*?([\'"])', _FORMAT_PATTERNS_2 = [r'(%(key)s\s*[=]\s*[\"\']).*?([\"\'])',
r'(%(key)s\s*--?[A-z]+\s*)\S+(\s*)'] r'(%(key)s\s+[\"\']).*?([\"\'])',
r'([-]{2}%(key)s\s+)[^\'^\"^=^\s]+([\s]*)',
r'(<%(key)s>).*?(</%(key)s>)',
r'([\"\']%(key)s[\"\']\s*:\s*[\"\']).*?([\"\'])',
r'([\'"].*?%(key)s[\'"]\s*:\s*u?[\'"]).*?([\'"])',
r'([\'"].*?%(key)s[\'"]\s*,\s*\'--?[A-z]+\'\s*,\s*u?'
'[\'"]).*?([\'"])',
r'(%(key)s\s*--?[A-z]+\s*)\S+(\s*)']
for key in _SANITIZE_KEYS: for key in _SANITIZE_KEYS:
for pattern in _FORMAT_PATTERNS: for pattern in _FORMAT_PATTERNS_2:
reg_ex = re.compile(pattern % {'key': key}, re.DOTALL) reg_ex = re.compile(pattern % {'key': key}, re.DOTALL)
_SANITIZE_PATTERNS.append(reg_ex) _SANITIZE_PATTERNS_2.append(reg_ex)
for pattern in _FORMAT_PATTERNS_1:
reg_ex = re.compile(pattern % {'key': key}, re.DOTALL)
_SANITIZE_PATTERNS_1.append(reg_ex)
def int_from_bool_as_string(subject): def int_from_bool_as_string(subject):
@@ -289,7 +300,12 @@ def mask_password(message, secret="***"):
if not any(key in message for key in _SANITIZE_KEYS): if not any(key in message for key in _SANITIZE_KEYS):
return message return message
secret = r'\g<1>' + secret + r'\g<2>' substitute = r'\g<1>' + secret + r'\g<2>'
for pattern in _SANITIZE_PATTERNS: for pattern in _SANITIZE_PATTERNS_2:
message = re.sub(pattern, secret, message) message = re.sub(pattern, substitute, message)
substitute = r'\g<1>' + secret
for pattern in _SANITIZE_PATTERNS_1:
message = re.sub(pattern, substitute, message)
return message return message