Skip to content

restrict ExceptionReporter

Bengfort requested to merge security-restrict-exception-reporter into main

To reproduce, add the following to your settings:

ADMINS = [('foo@localhost.com', 'asd@example.com')]
LOGGING = {
    'version': 1,
    'disable_existing_loggers': False,
    'handlers': {
        'console': {
            'class': 'logging.StreamHandler',
        },
        'mail_admins': {
            'level': 'ERROR',
            'class': 'django.utils.log.AdminEmailHandler',
        },
    },
    'root': {
        'handlers': ['console', 'mail_admins']
    },
}

Now trigger an exception in any view (e.g. by adding raise ValueError). In the console you should see the mail that is being sent to admins. It contains a lot of unnecessary and potentially dangerous information.

This MR significantly strips down the amount of information that is included in the mail. I am not sure whether this is the right place though. I feel like this should be decided either in django itself or per institute. On the other hand, institutes can always switch DEFAULT_EXCEPTION_REPORTER back to the default.

Edited by Bengfort

Merge request reports