Skip to content

Conversation

@niljub
Copy link

@niljub niljub commented Feb 8, 2026

This PR addresses a security issue in JIRAError.__str__ where full request and response details are included in the exception string, including sensitive headers and potentially sensitive request bodies.

When a JIRAError is logged, this can unintentionally leak:

  • Authorization headers (API tokens, OAuth tokens, Basic Auth credentials)
  • Cookie / Set-Cookie headers (session identifiers)
  • Request bodies containing secrets (e.g. passwords during user creation or update)

This PR introduces sanitization logic to mask sensitive headers and redact potentially sensitive request body content before rendering the exception string.

@niljub niljub requested a review from a team as a code owner February 8, 2026 20:38
@niljub niljub requested a review from adehad February 8, 2026 20:38
@github-actions
Copy link

github-actions bot commented Feb 8, 2026

Label error. Requires exactly 1 of: breaking, build, chore, ci, docs, feat, fix, perf, refactor, style, test. Found: . Follow https://www.conventionalcommits.org to get auto-labeling to work correctly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant