pax/booru-viewer
1
0
Fork 0
Code Issues Releases 18 Activity

security: fix #3 — redact params in GelbooruClient debug log

Browse Source 
Same fix as danbooru.py and e621.py — Gelbooru's params dict
carries api_key + user_id when configured. Route through
redact_params() before the debug log emits them.

Audit-Ref: SECURITY_AUDIT.md finding #3
Severity: Medium
This commit is contained in:
pax 2026-04-11 16:13:25 -05:00
parent 49fa2c5b7a
commit 19a22be59c
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
booru_viewer/core/api/gelbooru.py
View File

@ -5,6 +5,7 @@ from __future__ import annotations
import logging import logging
from ..config import DEFAULT_PAGE_SIZE from ..config import DEFAULT_PAGE_SIZE
from ._safety import redact_params
from .base import BooruClient, Post, _parse_date from .base import BooruClient, Post, _parse_date
log = logging.getLogger("booru") log = logging.getLogger("booru")
@ -43,7 +44,7 @@ class GelbooruClient(BooruClient):
url = f"{self.base_url}/index.php" url = f"{self.base_url}/index.php"
log.info(f"GET {url}") log.info(f"GET {url}")
log.debug(f" params: {params}") log.debug(f" params: {redact_params(params)}")
resp = await self._request("GET", url, params=params) resp = await self._request("GET", url, params=params)
log.info(f" -> {resp.status_code}") log.info(f" -> {resp.status_code}")
if resp.status_code != 200: if resp.status_code != 200: