jeans/core
jeans/core
1
0
Fork 0
mirror of https://github.com/home-assistant/core.git synced 2025-07-17 18:27:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Sanitize user-agent in wrong_login message (#45251)

Browse Source
This commit is contained in:
gregod 2021-01-18 08:21:30 +00:00 committed by GitHub
parent b2f914823d
commit cf9ea6f82d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
homeassistant/components/http/ban.py
View File

@ -105,16 +105,18 @@ async def process_wrong_login(request):
except herror: except herror:
pass pass
msg = f"Login attempt or request with invalid authentication from {remote_host} ({remote_addr})" base_msg = f"Login attempt or request with invalid authentication from {remote_host} ({remote_addr})."
# The user-agent is unsanitized input so we only include it in the log
user_agent = request.headers.get("user-agent") user_agent = request.headers.get("user-agent")
if user_agent: log_msg = f"{base_msg} ({user_agent})"
msg = f"{msg} ({user_agent})"
_LOGGER.warning(msg) notification_msg = f"{base_msg} See the log for details."
_LOGGER.warning(log_msg)
hass.components.persistent_notification.async_create( hass.components.persistent_notification.async_create(
msg, "Login attempt failed", NOTIFICATION_ID_LOGIN notification_msg, "Login attempt failed", NOTIFICATION_ID_LOGIN
) )
# Check if ban middleware is loaded # Check if ban middleware is loaded

4
tests/components/http/test_ban.py
View File

@ -174,8 +174,8 @@ async def test_ip_bans_file_creation(hass, aiohttp_client):
assert len(notification_calls) == 3 assert len(notification_calls) == 3
assert ( assert (
"Login attempt or request with invalid authentication from example.com (200.201.202.204) (Python" notification_calls[0].data["message"]
in notification_calls[0].data["message"] == "Login attempt or request with invalid authentication from example.com (200.201.202.204). See the log for details."
) )