From 89c729499e34acc10a2e16e27bcfe8683e338cb2 Mon Sep 17 00:00:00 2001 From: Michael Derynck Date: Fri, 14 Jul 2023 16:38:43 -0600 Subject: [PATCH 1/2] Fix authorization header so it is only masked for logging not the actual request --- engine/apps/webhooks/tasks/trigger_webhook.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/engine/apps/webhooks/tasks/trigger_webhook.py b/engine/apps/webhooks/tasks/trigger_webhook.py index 75585c3b90..86662d2541 100644 --- a/engine/apps/webhooks/tasks/trigger_webhook.py +++ b/engine/apps/webhooks/tasks/trigger_webhook.py @@ -96,9 +96,10 @@ def _build_payload(webhook, alert_group, user): def mask_authorization_header(headers): - if "Authorization" in headers: - headers["Authorization"] = WEBHOOK_FIELD_PLACEHOLDER - return headers + masked_headers = headers.copy() + if "Authorization" in masked_headers: + masked_headers["Authorization"] = WEBHOOK_FIELD_PLACEHOLDER + return masked_headers def make_request(webhook, alert_group, data): @@ -123,8 +124,8 @@ def make_request(webhook, alert_group, data): if triggered: status["url"] = webhook.build_url(data) request_kwargs = webhook.build_request_kwargs(data, raise_data_errors=True) - headers = mask_authorization_header(request_kwargs.get("headers", {})) - status["request_headers"] = json.dumps(headers) + display_headers = mask_authorization_header(request_kwargs.get("headers", {})) + status["request_headers"] = json.dumps(display_headers) if "json" in request_kwargs: status["request_data"] = json.dumps(request_kwargs["json"]) else: From e535fc727763280a91ccfd028a8499ca3cffd9e0 Mon Sep 17 00:00:00 2001 From: Michael Derynck Date: Fri, 14 Jul 2023 16:40:21 -0600 Subject: [PATCH 2/2] Update CHANGELOG.md --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index fc67849706..1614a6ffac 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Add `page_size`, `current_page_number`, and `total_pages` attributes to paginated API responses by @joeyorlando ([#2471](https://github.com/grafana/oncall/pull/2471)) +### Fixed + +- New webhooks incorrectly masking authorization header by @mderynck ([#2541](https://github.com/grafana/oncall/pull/2541)) + ## v1.3.11 (2023-07-13) ### Added