)]}'
{"oslo_context/context.py":[{"author":{"_account_id":26828,"name":"cjeanneret - deactivated","email":"cedric.jeanneret@camptocamp.com","username":"Tengu"},"change_message_id":"b8c2c67d200008fbfd3c221a47a58e93a45ef357","unresolved":false,"context_lines":[{"line_number":356,"context_line":"        # NOTE(jaosorior): Gotta filter the token since this dict is meant"},{"line_number":357,"context_line":"        # for logging and we shouldn\u0027t leak it."},{"line_number":358,"context_line":"        if \u0027auth_token\u0027 in values:"},{"line_number":359,"context_line":"            del values[\u0027auth_token\u0027]"},{"line_number":360,"context_line":"        return values"},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"    @property"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f4b6375_b532c65c","line":359,"updated":"2017-11-07 07:01:28.000000000","message":"In order to prevent any broken API, what about hashing the content of the var instead of dropping it? Should have thought about that before, sorry :/.","commit_id":"e5d4f211c2bb62b0904a7e17d6dd1497e966a1ce"},{"author":{"_account_id":26828,"name":"cjeanneret - deactivated","email":"cedric.jeanneret@camptocamp.com","username":"Tengu"},"change_message_id":"0f9302b4080893dedc6e0f50063961340563b4c8","unresolved":false,"context_lines":[{"line_number":356,"context_line":"        # NOTE(jaosorior): Gotta filter the token since this dict is meant"},{"line_number":357,"context_line":"        # for logging and we shouldn\u0027t leak it."},{"line_number":358,"context_line":"        if \u0027auth_token\u0027 in values:"},{"line_number":359,"context_line":"            del values[\u0027auth_token\u0027]"},{"line_number":360,"context_line":"        return values"},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"    @property"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f4b6375_55003234","line":359,"in_reply_to":"3f4b6375_3546d6c1","updated":"2017-11-07 07:10:51.000000000","message":"md5 might be sufficient in that case - fast enough, and we still don\u0027t give plain material for possible leak.","commit_id":"e5d4f211c2bb62b0904a7e17d6dd1497e966a1ce"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"3cb3526c2cb3f53c65a9a9ec1461fb59b5f9896f","unresolved":false,"context_lines":[{"line_number":356,"context_line":"        # NOTE(jaosorior): Gotta filter the token since this dict is meant"},{"line_number":357,"context_line":"        # for logging and we shouldn\u0027t leak it."},{"line_number":358,"context_line":"        if \u0027auth_token\u0027 in values:"},{"line_number":359,"context_line":"            del values[\u0027auth_token\u0027]"},{"line_number":360,"context_line":"        return values"},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"    @property"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f4b6375_3546d6c1","line":359,"in_reply_to":"3f4b6375_b532c65c","updated":"2017-11-07 07:02:23.000000000","message":"That could be an option. I\u0027m slightly concerned about the perfomance penalty, since this will be called per-log entry.","commit_id":"e5d4f211c2bb62b0904a7e17d6dd1497e966a1ce"},{"author":{"_account_id":2813,"name":"Mehdi Abaakouk","email":"sileht@sileht.net","username":"sileht"},"change_message_id":"b638445f020124f26d85b42ddfb6aa09c1128f52","unresolved":false,"context_lines":[{"line_number":360,"context_line":"        else:"},{"line_number":361,"context_line":"            # NOTE(jaosorior): Gotta filter the token since this dict is meant"},{"line_number":362,"context_line":"            # for logging and we shouldn\u0027t leak it."},{"line_number":363,"context_line":"            values[\u0027auth_token\u0027] \u003d None"},{"line_number":364,"context_line":""},{"line_number":365,"context_line":"        return values"},{"line_number":366,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"3f4b6375_e7a3f541","line":363,"updated":"2017-11-07 08:21:12.000000000","message":"Why we don\u0027t use oslo.utils mask_password like any other place we log auth_token ?","commit_id":"78a3fba01c7da2e2ca5a775118897e8afa0304be"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a2ed26c4d2ac5ff26f8e2fc75469a6e17c928d19","unresolved":false,"context_lines":[{"line_number":360,"context_line":"        else:"},{"line_number":361,"context_line":"            # NOTE(jaosorior): Gotta filter the token since this dict is meant"},{"line_number":362,"context_line":"            # for logging and we shouldn\u0027t leak it."},{"line_number":363,"context_line":"            values[\u0027auth_token\u0027] \u003d None"},{"line_number":364,"context_line":""},{"line_number":365,"context_line":"        return values"},{"line_number":366,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"3f4b6375_7d0c34eb","line":363,"in_reply_to":"3f4b6375_2a94348a","updated":"2017-11-07 09:45:32.000000000","message":"I think we expect to track requests by the request id, not the user id. So I think it\u0027s fine to just remove the value. I don\u0027t like the idea of obfuscating it by hashing it.","commit_id":"78a3fba01c7da2e2ca5a775118897e8afa0304be"},{"author":{"_account_id":26828,"name":"cjeanneret - deactivated","email":"cedric.jeanneret@camptocamp.com","username":"Tengu"},"change_message_id":"dc569cff36e202d642035687bdf0517b92f7ba46","unresolved":false,"context_lines":[{"line_number":360,"context_line":"        else:"},{"line_number":361,"context_line":"            # NOTE(jaosorior): Gotta filter the token since this dict is meant"},{"line_number":362,"context_line":"            # for logging and we shouldn\u0027t leak it."},{"line_number":363,"context_line":"            values[\u0027auth_token\u0027] \u003d None"},{"line_number":364,"context_line":""},{"line_number":365,"context_line":"        return values"},{"line_number":366,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"3f4b6375_2a94348a","line":363,"in_reply_to":"3f4b6375_4a141044","updated":"2017-11-07 08:36:32.000000000","message":"@Mehdi: we didn\u0027t know that one, but in fact it won\u0027t do what we need, as it apparently searches patterns in plain strings. It\u0027s not applicable in a pure dict context I think.\n\nMore over, we\u0027d still like to get a distinct string in order to be able to follow the auth_token across logs (for example in order to ensure it\u0027s attached to the same user for all queries). The mask_password won\u0027t do that as it will replace any password with the very same string, by default \u0027***\u0027.\n\nThanks for the pointer :).","commit_id":"78a3fba01c7da2e2ca5a775118897e8afa0304be"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"e241c37bb43965afdf025197788bc74f57d1c64c","unresolved":false,"context_lines":[{"line_number":360,"context_line":"        else:"},{"line_number":361,"context_line":"            # NOTE(jaosorior): Gotta filter the token since this dict is meant"},{"line_number":362,"context_line":"            # for logging and we shouldn\u0027t leak it."},{"line_number":363,"context_line":"            values[\u0027auth_token\u0027] \u003d None"},{"line_number":364,"context_line":""},{"line_number":365,"context_line":"        return values"},{"line_number":366,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"3f4b6375_4a141044","line":363,"in_reply_to":"3f4b6375_e7a3f541","updated":"2017-11-07 08:28:44.000000000","message":"Hey! thanks for the suggestion. So, that might be useful, however, using merely a None here is more lightweight IMO, and it doesn\u0027t introduce an extra dependency.\n\nFor the case above, having a hash would allow log parsers to identify a specific token and with that perhaps spot a malicious actor.","commit_id":"78a3fba01c7da2e2ca5a775118897e8afa0304be"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"4a49fbb4296d9545202aac0e1a0d127529b152f7","unresolved":false,"context_lines":[{"line_number":346,"context_line":"                \u0027user_identity\u0027: user_idt,"},{"line_number":347,"context_line":"                \u0027is_admin_project\u0027: self.is_admin_project}"},{"line_number":348,"context_line":""},{"line_number":349,"context_line":"    def get_logging_values(self, get_hashed_token\u003dFalse, salt\u003db\u0027oslo.ctx\u0027):"},{"line_number":350,"context_line":"        \"\"\"Return a dictionary of logging specific context attributes.\"\"\""},{"line_number":351,"context_line":"        values \u003d {\u0027user_name\u0027: self.user_name,"},{"line_number":352,"context_line":"                  \u0027project_name\u0027: self.project_name,"}],"source_content_type":"text/x-python","patch_set":9,"id":"3f4b6375_eade1c68","line":349,"updated":"2017-11-07 08:37:50.000000000","message":"I would like more opinions on the get_hashed_token default.\n\nRight now it defaults to False, however, there is the possibility that we enable this by default. What do people think?\n\nthe main reason this was made configurable and disabled by default, is that it might have a performance penatly, since this would be used for every log entry, as it\u0027s used by oslo.log. However, having this functionality provides very useful log info.\n\nThe use-case for having this hash is to be able to identify tokens that are used, and from that perhaps identify a stolen token or a malicious actor.","commit_id":"debfb6497f37c7aa6a7e27d0816fa887a6ab6509"}]}