Add test

src/pretix/base/models/base.py

@@ -151,12 +151,29 @@ class LoggingMixin:
         logentry = LogEntry(content_object=self, user=user, action_type=action, event=event,
                             organizer_id=organizer_id, **kwargs)
         if isinstance(data, dict):
-            sensitivekeys = ['password', 'secret', 'api_key']
+            # sensitivekeys are matched whether contained, not exactly
+            sensitivekeys = [
+                'auth',
+                'key',
+                'token',
+                'password',
+                'Password',
+                '_pass',
+                'salt',
+                'secret',
+            ]
 
-            for sensitivekey in sensitivekeys:
-                for k, v in data.items():
-                    if (sensitivekey in k) and v:
+            def clean_recursive(d):
+                data = d
+                data_iterator = d.items() if isinstance(d, dict) else enumerate(d)
+                for k, v in data_iterator:
+                    if v and any([sensitivekey in str(k) for sensitivekey in sensitivekeys]):
                         data[k] = "********"
+                    elif isinstance(v, (list, dict)):
+                        data[k] = clean_recursive(v)
+                return data
+
+            data = clean_recursive(data)
 
             logentry.data = json.dumps(data, cls=CustomJSONEncoder, sort_keys=True)
         elif data:

src/tests/base/test_shredders.py

@@ -94,6 +94,83 @@ def question(event, item):
     return q
 
 
+@pytest.mark.django_db
+def test_log_action_filter(event, order):
+    sensitivekeys = [
+        'auth',
+        'key',
+        'token',
+        'password',
+        'Password',
+        '_pass',
+        'salt',
+        'secret',
+    ]
+    log_data = log_data_filtered = {
+        'foo': 'bar',
+    }
+    for d in (log_data, log_data_filtered):
+        value = '********' if d == log_data_filtered else '__sensitive_info__'
+        for k in sensitivekeys:
+            d[k] = d['prefix' + k] = d['prefix' + k + 'suffix'] = d[k + 'suffix'] = value
+
+        d['recursive_dict'] = {
+            'test': 'dummy',
+            'test_token': value,
+            'd': {
+                'baz': 'foo',
+                'mypassword': value,
+                'l': [
+                    'foo',
+                    'bar',
+                    {
+                        'baz': True,
+                        'superkey': value,
+                    },
+                ],
+            },
+            'l': [
+                'okay',
+                {
+                    'salt_to_secret': value,
+                    'name': 'okay'
+                },
+                'element',
+                [
+                    'another',
+                    {
+                        'api_password': value,
+                    },
+                    'list'
+                ]
+            ]
+        }
+        d['recursive_list'] = [
+            'foo',
+            'bar',
+            [
+                'foo',
+                'bar',
+                {
+                    'foo': 'bar',
+                    'api_token': value,
+                },
+                'baz',
+            ],
+            {
+                'foo': 'bar',
+                'MyPassword': value,
+            }
+        ]
+    l1 = order.log_action(
+        'dummy.log',
+        data=log_data,
+    )
+
+    l1.refresh_from_db()
+    assert json.loads(l1.data) == log_data_filtered
+
+
 @pytest.mark.django_db
 def test_email_shredder(event, order):
     l1 = order.log_action(