Merge branch 'master' into no-compress-media

actix-test/CHANGES.md

@@ -2,6 +2,7 @@
 
 ## Unreleased - 2023-xx-xx
 
+- Add `TestServerConfig::workers()` setter method.
 - Minimum supported Rust version (MSRV) is now 1.65 due to transitive `time` dependency.
 
 ## 0.1.1 - 2023-02-26

actix-test/src/lib.rs

@@ -154,7 +154,10 @@ where
             let srv_cfg = cfg.clone();
             let timeout = cfg.client_request_timeout;
 
-            let builder = Server::build().workers(1).disable_signals().system_exit();
+            let builder = Server::build()
+                .workers(cfg.workers)
+                .disable_signals()
+                .system_exit();
 
             let srv = match srv_cfg.stream {
                 StreamType::Tcp => match srv_cfg.tp {
@@ -367,6 +370,7 @@ pub struct TestServerConfig {
     stream: StreamType,
     client_request_timeout: Duration,
     port: u16,
+    workers: usize,
 }
 
 impl Default for TestServerConfig {
@@ -383,6 +387,7 @@ impl TestServerConfig {
             stream: StreamType::Tcp,
             client_request_timeout: Duration::from_secs(5),
             port: 0,
+            workers: 1,
         }
     }
 
@@ -425,6 +430,14 @@ impl TestServerConfig {
         self.port = port;
         self
     }
+
+    /// Sets number of workers for the test server.
+    ///
+    /// By default, the server uses 1 worker
+    pub fn workers(mut self, workers: usize) -> Self {
+        self.workers = workers;
+        self
+    }
 }
 
 /// A basic HTTP server controller that simplifies the process of writing integration tests for

actix-web/CHANGES.md

@@ -11,6 +11,7 @@
 
 - Handler functions can now receive up to 16 extractor parameters.
 - The `Compress` no longer compresses image or video content by default.
+- Hide sensitive header values in `HttpRequest`'s `Debug` output.
 - Minimum supported Rust version (MSRV) is now 1.65 due to transitive `time` dependency.
 
 ## 4.3.1 - 2023-02-26

actix-web/src/request.rs

@@ -435,16 +435,28 @@ impl fmt::Debug for HttpRequest {
             self.inner.head.method,
             self.path()
         )?;
+
         if !self.query_string().is_empty() {
             writeln!(f, "  query: ?{:?}", self.query_string())?;
         }
+
         if !self.match_info().is_empty() {
             writeln!(f, "  params: {:?}", self.match_info())?;
         }
+
         writeln!(f, "  headers:")?;
+
         for (key, val) in self.headers().iter() {
-            writeln!(f, "    {:?}: {:?}", key, val)?;
+            match key {
+                // redact sensitive header values from debug output
+                &crate::http::header::AUTHORIZATION
+                | &crate::http::header::PROXY_AUTHORIZATION
+                | &crate::http::header::COOKIE => writeln!(f, "    {:?}: {:?}", key, "*redacted*")?,
+
+                _ => writeln!(f, "    {:?}: {:?}", key, val)?,
+            }
         }
+
         Ok(())
     }
 }
@@ -908,4 +920,47 @@ mod tests {
         let body = read_body(bar_resp).await;
         assert_eq!(body, "http://localhost:8080/bar/nested");
     }
+
+    #[test]
+    fn authorization_header_hidden_in_debug() {
+        let authorization_header = "Basic bXkgdXNlcm5hbWU6bXkgcGFzc3dvcmQK";
+        let req = TestRequest::get()
+            .insert_header((crate::http::header::AUTHORIZATION, authorization_header))
+            .to_http_request();
+
+        assert!(!format!("{:?}", req).contains(authorization_header));
+    }
+
+    #[test]
+    fn proxy_authorization_header_hidden_in_debug() {
+        let proxy_authorization_header = "secret value";
+        let req = TestRequest::get()
+            .insert_header((
+                crate::http::header::PROXY_AUTHORIZATION,
+                proxy_authorization_header,
+            ))
+            .to_http_request();
+
+        assert!(!format!("{:?}", req).contains(proxy_authorization_header));
+    }
+
+    #[test]
+    fn cookie_header_hidden_in_debug() {
+        let cookie_header = "secret";
+        let req = TestRequest::get()
+            .insert_header((crate::http::header::COOKIE, cookie_header))
+            .to_http_request();
+
+        assert!(!format!("{:?}", req).contains(cookie_header));
+    }
+
+    #[test]
+    fn other_header_visible_in_debug() {
+        let location_header = "192.0.0.1";
+        let req = TestRequest::get()
+            .insert_header((crate::http::header::LOCATION, location_header))
+            .to_http_request();
+
+        assert!(format!("{:?}", req).contains(location_header));
+    }
 }