From: Fitz Elliott <fitz@cos.io>
Date: Thu, 10 Aug 2017 15:10:00 +0000 (-0400)
Subject: Remove headers from HTTPServerRequest repr
X-Git-Tag: v5.0.0~60^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F2132%2Fhead;p=thirdparty%2Ftornado.git

Remove headers from HTTPServerRequest repr

 * In tornadoweb/tornado#1112 it was decided to stop including headers
   in the request repr, since they are needlessly verbose and risk
   leaking user secrets into the application log.
---

diff --git a/tornado/httputil.py b/tornado/httputil.py
index a98273aec..f2b289b32 100755
--- a/tornado/httputil.py
+++ b/tornado/httputil.py
@@ -467,8 +467,7 @@ class HTTPServerRequest(object):
     def __repr__(self):
         attrs = ("protocol", "host", "method", "uri", "version", "remote_ip")
         args = ", ".join(["%s=%r" % (n, getattr(self, n)) for n in attrs])
-        return "%s(%s, headers=%s)" % (
-            self.__class__.__name__, args, dict(self.headers))
+        return "%s(%s)" % (self.__class__.__name__, args)
 
 
 class HTTPInputError(Exception):
diff --git a/tornado/test/httputil_test.py b/tornado/test/httputil_test.py
index 7ac799257..1521ca03e 100644
--- a/tornado/test/httputil_test.py
+++ b/tornado/test/httputil_test.py
@@ -418,6 +418,10 @@ class HTTPServerRequestTest(unittest.TestCase):
         requets = HTTPServerRequest(uri='/')
         self.assertIsInstance(requets.body, bytes)
 
+    def test_repr_does_not_contain_headers(self):
+        request = HTTPServerRequest(uri='/', headers={'Canary': 'Coal Mine'})
+        self.assertTrue('Canary' not in repr(request))
+
 
 class ParseRequestStartLineTest(unittest.TestCase):
     METHOD = "GET"