Fix : hide http push security token in the subscribers api [SDESK-7093]

apps/publish/publish_service_tests.py

@@ -44,7 +44,52 @@ class PublishServiceTests(TestCase):
             "sequence_num_settings": {"max": 10, "min": 1},
             "critical_errors": {"9004": True},
             "destinations": [{"name": "NITF", "delivery_type": "ftp", "format": "nitf", "config": {}}],
-        }
+        },
+        {
+            "_id": "2",
+            "name": "Test2",
+            "subscriber_type": SUBSCRIBER_TYPES.WIRE,
+            "media_type": "media",
+            "is_active": True,
+            "sequence_num_settings": {"max": 10, "min": 1},
+            "critical_errors": {"9004": True},
+            "destinations": [
+                {
+                    "name": "HTTP PUSH",
+                    "delivery_type": "http_push",
+                    "format": "nitf",
+                    "config": {
+                        "resource_url": "http://localhost:5050/push",
+                        "assets_url": "http://localhost:5050/push_binary",
+                        "packaged": "true",
+                        "secret_token": "newsroom",
+                    },
+                }
+            ],
+        },
+        {
+            "_id": "3",
+            "name": "Test3",
+            "subscriber_type": SUBSCRIBER_TYPES.WIRE,
+            "media_type": "media",
+            "is_active": True,
+            "sequence_num_settings": {"max": 10, "min": 1},
+            "critical_errors": {"9004": True},
+            "destinations": [
+                {
+                    "name": "AMAZON SQS",
+                    "delivery_type": "amazon_sqs_fifo",
+                    "format": "nitf",
+                    "config": {
+                        "access_key_id": "demokeyaccess",
+                        "attach_media": False,
+                        "message_group_id": "messageGroupId",
+                        "queue_name": "demo test",
+                        "secret_access_key": "accesskey",
+                    },
+                }
+            ],
+        },
     ]
 
     def setUp(self):
@@ -114,3 +159,15 @@ def test_highlight_query(self):
         self.assertEqual(
             ["body_html", "body_footer", "headline", "slugline", "abstract"], list(source["highlight"]["fields"].keys())
         )
+
+    def test_subscribers_secret_keys(self):
+        subscriber_service = superdesk.get_resource_service("subscribers")
+        data = list(subscriber_service.get(req=None, lookup={}))
+        item = data[1]
+        self.assertEqual("Test2", item["name"])
+        self.assertNotIn("secret_token", item["destinations"][0]["config"])
+
+        item = data[2]
+        self.assertEqual("Test3", item["name"])
+        self.assertNotIn("access_key_id", item["destinations"][0]["config"])
+        self.assertNotIn("secret_access_key", item["destinations"][0]["config"])

superdesk/publish/subscribers.py

@@ -103,12 +103,14 @@ class SubscribersService(CacheableService):
     cache_lookup = {"is_active": True}
 
     def get(self, req, lookup):
+        fields = ("secret_token", "password", "apiKey", "access_key_id", "secret_access_key")
         if req is None:
             req = ParsedRequest()
         if req.args and req.args.get("filter_condition"):
             filter_condition = json.loads(req.args.get("filter_condition"))
-            return ListCursor(self._get_subscribers_by_filter_condition(filter_condition))
-        return super().get_from_mongo(req=req, lookup=lookup)
+            return self.hideConfigField(self._get_subscribers_by_filter_condition(filter_condition), fields)
+
+        return self.hideConfigField(list(super().get_from_mongo(req=req, lookup=lookup)), fields)
 
     def on_create(self, docs):
         for doc in docs:
@@ -291,3 +293,20 @@ def generate_sequence_number(self, subscriber):
 
     def get_active(self):
         return self.get_cached()
+
+    def hideConfigField(self, docs, fields):
+        return ListCursor(
+            [
+                {
+                    **doc,
+                    "destinations": [
+                        {
+                            **destination,
+                            "config": {key: value for key, value in destination["config"].items() if key not in fields},
+                        }
+                        for destination in doc.get("destinations", [])
+                    ],
+                }
+                for doc in docs
+            ]
+        )