Fix: Remove secrets from URI in financial accounting backend errors.

django/cohiva/tests/test_utils_strings.py

@@ -0,0 +1,41 @@
+from django.test import TestCase
+
+from cohiva.utils.strings import sanitize_log_message
+
+
+class UtilsStringsTestCase(TestCase):
+    def test_sanitize_log_message_no_uri(self):
+        text = "Normal text without URI"
+        safe_text = sanitize_log_message(text)
+        self.assertEqual(safe_text, text)
+
+    def test_sanitize_log_message_uri_without_password(self):
+        text = "Normal text without URI but no password https://user@host/path?bla=1 more text"
+        safe_text = sanitize_log_message(text)
+        self.assertEqual(safe_text, text)
+
+    def test_sanitize_log_message_uri_https(self):
+        safe_text = sanitize_log_message("https://user:_SECRET_@host")
+        self.assertEqual(safe_text, "https://user:******@host")
+
+    def test_sanitize_log_message_uri_https_with_text(self):
+        safe_text = sanitize_log_message("Text https://user:_SECRET_@host more text")
+        self.assertEqual(safe_text, "Text https://user:******@host more text")
+
+    def test_sanitize_log_message_uri_mysql(self):
+        safe_text = sanitize_log_message("Text mysql://user:_SECRET_@host more text")
+        self.assertEqual(safe_text, "Text mysql://user:******@host more text")
+
+    def test_sanitize_log_message_multiple_uris(self):
+        text = (
+            "Text https://user:_SECRET_@host more text "
+            "mysql://user:_SECRET_@host/path/to/?query=1 more text"
+        )
+        safe_text = sanitize_log_message(text)
+        self.assertEqual(
+            safe_text,
+            (
+                "Text https://user:******@host more text "
+                "mysql://user:******@host/path/to/?query=1 more text"
+            ),
+        )

django/cohiva/utils/strings.py

@@ -1,4 +1,21 @@
+import re
+
+
 def pluralize(count, singular, plural):
     if count == 1:
         return f"1 {singular}"
     return f"{count} {plural}"
+
+
+def sanitize_log_message(text: str):
+    return _sanitize_uris(text)
+
+
+def _sanitize_uris(text: str):
+    pattern = (
+        r"\b(?P<protocol>[a-zA-Z][a-zA-Z0-9+.-]*)://"
+        r"(?P<username>[^:@/\s]+):(?P<password>[^@/\s]+)@"
+        r"(?P<host>[^/\s?#]+)"
+    )
+    safe_text = re.sub(pattern, r"\g<protocol>://\g<username>:******@\g<host>", text)
+    return safe_text

django/finance/accounting/manager.py

@@ -3,6 +3,7 @@
 
 from django.conf import settings
 
+from cohiva.utils.strings import sanitize_log_message
 from finance.accounting import CashctrlBook, DummyBook, GnucashBook
 
 logger = logging.getLogger("finance_accounting")
@@ -119,9 +120,12 @@ def __enter__(self) -> CashctrlBook | GnucashBook | DummyBook | None:
                 self.backend_obj = self.backend_class(self.backend_label, self.db_id)
                 return self.backend_obj
             except Exception as e:
-                logger.error(f"Couldn't initialize accounting backend {self.backend_class}: {e}")
+                error_msg = sanitize_log_message(str(e))
+                logger.error(
+                    f"Couldn't initialize accounting backend {self.backend_class}: {error_msg}"
+                )
                 if self.messages is not None:
-                    self.messages.append(f"Konnte Buchhaltung nicht initialisieren: {e}")
+                    self.messages.append(f"Konnte Buchhaltung nicht initialisieren: {error_msg}")
                     return None
                 raise e