[airavata-django-portal] branch master updated: Use formatter that prevents CRLF injection attacks

[ma...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

machristie pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/airavata-django-portal.git


The following commit(s) were added to refs/heads/master by this push:
     new 3c5d8c7  Use formatter that prevents CRLF injection attacks
3c5d8c7 is described below

commit 3c5d8c72bfc3eb0af8693a655a5d60f9273f8170
Author: Marcus Christie <ma...@apache.org>
AuthorDate: Mon Dec 6 13:55:09 2021 -0500

    Use formatter that prevents CRLF injection attacks
---
 django_airavata/settings.py | 8 ++++++--
 requirements.txt            | 1 +
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/django_airavata/settings.py b/django_airavata/settings.py
index 90f0ef4..930c36a 100644
--- a/django_airavata/settings.py
+++ b/django_airavata/settings.py
@@ -360,7 +360,11 @@ LOGGING = {
     },
     'formatters': {
         'verbose': {
-            'format': '[%(asctime)s %(name)s:%(lineno)d %(levelname)s] %(message)s'
+            'format': '[%(asctime)s %(name)s:%(lineno)d %(levelname)s] %(message)s',
+        },
+        'verbose-safe': {
+            '()': 'anticrlf.LogFormatter',
+            'format': '[%(asctime)s %(name)s:%(lineno)d %(levelname)s] %(message)s',
         },
     },
     'handlers': {
@@ -374,7 +378,7 @@ LOGGING = {
         'console': {
             'filters': ['require_debug_false'],
             'class': 'logging.StreamHandler',
-            'formatter': 'verbose',
+            'formatter': 'verbose-safe',
             'level': 'INFO'
         },
         'mail_admins': {
diff --git a/requirements.txt b/requirements.txt
index 62a1215..f70278c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -6,6 +6,7 @@ thrift==0.10.0
 thrift_connector==0.24
 djangorestframework==3.12.4
 django-webpack-loader==0.6.0
+logging-formatter-anticrlf==1.2
 
 wagtail==2.13.4
 wagtailfontawesome==1.2.1