Fix shared memory issue when stripping authorization header from bid requests

exchange/bidder.go

@@ -167,10 +167,6 @@ func (bidder *bidderAdapter) requestBid(ctx context.Context, request *openrtb2.B
 		if debugInfo := ctx.Value(DebugContextKey); debugInfo != nil && debugInfo.(bool) {
 			if accountDebugAllowed {
 				if bidder.config.DebugInfo.Allow {
-					// it's safe to mutate the request headers since from this point on the
-					// information is only used for debugging.
-					removeSensitiveHeaders(httpInfo.request.Headers)
-
 					seatBid.httpCalls = append(seatBid.httpCalls, makeExt(httpInfo))
 				} else {
 					debugDisabledWarning := errortypes.Warning{
@@ -331,9 +327,10 @@ func getAssetByID(id int64, assets []nativeRequests.Asset) (nativeRequests.Asset
 
 var authorizationHeader = http.CanonicalHeaderKey("authorization")
 
-// removeSensitiveHeaders mutates the http header object to remove sensitive information.
-func removeSensitiveHeaders(h http.Header) {
-	h.Del(authorizationHeader)
+func filterHeader(h http.Header) map[string][]string {
+	clone := h.Clone()
+	clone.Del(authorizationHeader)
+	return clone
 }
 
 // makeExt transforms information about the HTTP call into the contract class for the PBS response.
@@ -343,7 +340,7 @@ func makeExt(httpInfo *httpCallInfo) *openrtb_ext.ExtHttpCall {
 	if httpInfo != nil && httpInfo.request != nil {
 		ext.Uri = httpInfo.request.Uri
 		ext.RequestBody = string(httpInfo.request.Body)
-		ext.RequestHeaders = httpInfo.request.Headers
+		ext.RequestHeaders = filterHeader(httpInfo.request.Headers)
 
 		if httpInfo.err == nil && httpInfo.response != nil {
 			ext.ResponseBody = string(httpInfo.response.Body)

exchange/bidder_test.go

@@ -141,48 +141,6 @@ func TestSingleBidder(t *testing.T) {
 	}
 }
 
-func TestRequestBidRemovesSensitiveHeaders(t *testing.T) {
-	server := httptest.NewServer(mockHandler(200, "getBody", "responseJson"))
-	defer server.Close()
-
-	requestHeaders := http.Header{}
-	requestHeaders.Add("Content-Type", "application/json")
-	requestHeaders.Add("Authorization", "anySecret")
-
-	bidderImpl := &goodSingleBidder{
-		httpRequest: &adapters.RequestData{
-			Method:  "POST",
-			Uri:     server.URL,
-			Body:    []byte("requestJson"),
-			Headers: requestHeaders,
-		},
-		bidResponse: &adapters.BidderResponse{
-			Bids: []*adapters.TypedBid{},
-		},
-	}
-
-	debugInfo := &config.DebugInfo{Allow: true}
-	ctx := context.Background()
-	ctx = context.WithValue(ctx, DebugContextKey, true)
-
-	bidder := adaptBidder(bidderImpl, server.Client(), &config.Configuration{}, &metricsConfig.DummyMetricsEngine{}, openrtb_ext.BidderAppnexus, debugInfo)
-	currencyConverter := currency.NewRateConverter(&http.Client{}, "", time.Duration(0))
-	seatBid, errs := bidder.requestBid(ctx, &openrtb2.BidRequest{}, "test", 1, currencyConverter.Rates(), &adapters.ExtraRequestInfo{}, true)
-
-	expectedHttpCalls := []*openrtb_ext.ExtHttpCall{
-		{
-			Uri:            server.URL,
-			RequestBody:    "requestJson",
-			RequestHeaders: map[string][]string{"Content-Type": {"application/json"}},
-			ResponseBody:   "responseJson",
-			Status:         200,
-		},
-	}
-
-	assert.Empty(t, errs)
-	assert.ElementsMatch(t, seatBid.httpCalls, expectedHttpCalls)
-}
-
 // TestMultiBidder makes sure all the requests get sent, and the responses processed.
 // Because this is done in parallel, it should be run under the race detector.
 func TestMultiBidder(t *testing.T) {
@@ -953,13 +911,13 @@ func TestMakeExt(t *testing.T) {
 			expected: &openrtb_ext.ExtHttpCall{},
 		},
 		{
-			description: "Request & Response - No Error",
+			description: "Request & Response - No Error with Authorization removal",
 			given: &httpCallInfo{
 				err: nil,
 				request: &adapters.RequestData{
 					Uri:     "requestUri",
 					Body:    []byte("requestBody"),
-					Headers: makeHeader(map[string][]string{"Key1": {"value1", "value2"}}),
+					Headers: makeHeader(map[string][]string{"Key1": {"value1", "value2"}, "Authorization": {"secret"}}),
 				},
 				response: &adapters.ResponseData{
 					Body:       []byte("responseBody"),
@@ -974,6 +932,28 @@ func TestMakeExt(t *testing.T) {
 				Status:         999,
 			},
 		},
+		{
+			description: "Request & Response - No Error with nil header",
+			given: &httpCallInfo{
+				err: nil,
+				request: &adapters.RequestData{
+					Uri:     "requestUri",
+					Body:    []byte("requestBody"),
+					Headers: nil,
+				},
+				response: &adapters.ResponseData{
+					Body:       []byte("responseBody"),
+					StatusCode: 999,
+				},
+			},
+			expected: &openrtb_ext.ExtHttpCall{
+				Uri:            "requestUri",
+				RequestBody:    "requestBody",
+				RequestHeaders: nil,
+				ResponseBody:   "responseBody",
+				Status:         999,
+			},
+		},
 		{
 			description: "Request & Response - Error",
 			given: &httpCallInfo{
@@ -1029,11 +1009,11 @@ func TestMakeExt(t *testing.T) {
 	}
 }
 
-func TestRemoveSensitiveHeaders(t *testing.T) {
+func TestFilterHeader(t *testing.T) {
 	testCases := []struct {
 		description string
 		given       http.Header
-		expected    http.Header
+		expected    map[string][]string
 	}{
 		{
 			description: "Nil",
@@ -1048,33 +1028,33 @@ func TestRemoveSensitiveHeaders(t *testing.T) {
 		{
 			description: "One",
 			given:       makeHeader(map[string][]string{"Key1": {"value1"}}),
-			expected:    makeHeader(map[string][]string{"Key1": {"value1"}}),
+			expected:    map[string][]string{"Key1": {"value1"}},
 		},
 		{
 			description: "Many",
 			given:       makeHeader(map[string][]string{"Key1": {"value1"}, "Key2": {"value2a", "value2b"}}),
-			expected:    makeHeader(map[string][]string{"Key1": {"value1"}, "Key2": {"value2a", "value2b"}}),
+			expected:    map[string][]string{"Key1": {"value1"}, "Key2": {"value2a", "value2b"}},
 		},
 		{
 			description: "Authorization Header Omitted",
 			given:       makeHeader(map[string][]string{"authorization": {"secret"}}),
-			expected:    http.Header{},
+			expected:    map[string][]string{},
 		},
 		{
 			description: "Authorization Header Omitted - Case Insensitive",
 			given:       makeHeader(map[string][]string{"AuThOrIzAtIoN": {"secret"}}),
-			expected:    http.Header{},
+			expected:    map[string][]string{},
 		},
 		{
 			description: "Authorization Header Omitted + Other Keys",
 			given:       makeHeader(map[string][]string{"authorization": {"secret"}, "Key1": {"value1"}}),
-			expected:    makeHeader(map[string][]string{"Key1": {"value1"}}),
+			expected:    map[string][]string{"Key1": {"value1"}},
 		},
 	}
 
 	for _, test := range testCases {
-		removeSensitiveHeaders(test.given)
-		assert.Equal(t, test.expected, test.given, test.description)
+		result := filterHeader(test.given)
+		assert.Equal(t, test.expected, result, test.description)
 	}
 }