Make redaction recursive in local_vars

Change-Id: I5e9050116d4790ba693e0d4379a1d05df0306c40

Author: Shortfinga

packages/cmk-ccc/cmk/ccc/crash_reporting.py

@@ -283,10 +283,13 @@ def _get_generic_crash_info(
 
 
 def _get_local_vars_of_last_exception() -> str:
+    local_vars = {}
+
     # Suppressing to handle case where sys.exc_info has no crash information
     # (https://docs.python.org/2/library/sys.html#sys.exc_info)
     with suppress(IndexError):
-        local_vars = _sanitize_variables(inspect.trace()[-1][0].f_locals)
+        for key, val in inspect.trace()[-1][0].f_locals.items():
+            local_vars[key] = _format_var_for_export(val)
     # This needs to be encoded as the local vars might contain binary data which can not be
     # transported using JSON.
     return base64.b64encode(
@@ -310,7 +313,12 @@ def _format_var_for_export(val: Any, maxdepth: int = 4, maxsize: int = 1024 * 10
     if isinstance(val, dict):
         val = val.copy()
         for item_key, item_val in val.items():
-            val[item_key] = _format_var_for_export(item_val, maxdepth - 1)
+            if any(
+                sensitive_keyword in item_key.lower() for sensitive_keyword in SENSITIVE_KEYWORDS
+            ):
+                val[item_key] = REDACTED_STRING
+            else:
+                val[item_key] = _format_var_for_export(item_val, maxdepth - 1)
 
     elif isinstance(val, list):
         val = val[:]

tests/unit/cmk/utils/test_crash_reporting.py

@@ -3,7 +3,7 @@
 # This file is part of Checkmk (https://checkmk.com). It is subject to the terms and
 # conditions defined in the file COPYING, which is part of this source code package.
 
-
+import base64
 import copy
 import itertools
 import json
@@ -38,6 +38,8 @@ def crashdir(tmp_path: Path) -> Path:
 @pytest.fixture()
 def crash(crashdir: Path) -> UnitTestCrashReport:
     try:
+        # We need some var so the local_vars are part of the crash report
+        some_local_var = [{"foo": {"deep": True, "password": "verysecret", "foo": "notsecret"}}]  # noqa: F841
         raise ValueError("XYZ")
     except ValueError:
         return UnitTestCrashReport(
@@ -71,6 +73,12 @@ def test_crash_report_sanitization(crash: ABCCrashReport) -> None:
     }
 
 
+def test_crash_report_sanitization_local_vars(crash: ABCCrashReport) -> None:
+    decoded_local_vars = base64.b64decode(crash.crash_info["local_vars"])
+    assert b"verysecret" not in decoded_local_vars
+    assert b"notsecret" in decoded_local_vars
+
+
 def test_crash_report_ident(crash: ABCCrashReport) -> None:
     assert crash.ident() == (crash.crash_info["id"],)