Skip to content

Conversation

@niljub
Copy link

@niljub niljub commented Feb 8, 2026

This PR addresses a security issue in JIRAError.__str__ where full request and response details are included in the exception string, including sensitive headers and potentially sensitive request bodies.

When a JIRAError is logged, this can unintentionally leak:

  • Authorization headers (API tokens, OAuth tokens, Basic Auth credentials)
  • Cookie / Set-Cookie headers (session identifiers)
  • Request bodies containing secrets (e.g. passwords during user creation or update)

This PR introduces sanitization logic to mask sensitive headers and redact potentially sensitive request body content before rendering the exception string.

@niljub niljub requested a review from a team as a code owner February 8, 2026 20:45
@niljub niljub requested a review from ssbarnea February 8, 2026 20:45
@github-actions github-actions bot added the fix label Feb 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant