Merge pull request #244 from ozeebee/master

fixes #243 Credentials exposed

stomp/listener.py

@@ -499,7 +499,7 @@ def on_send(self, frame):
         """
         :param Frame frame:
         """
-        print('on_send %s %s %s' % (frame.cmd, frame.headers, frame.body))
+        print('on_send %s %s %s' % (frame.cmd, utils.clean_headers(frame.headers), frame.body))
 
     def on_heartbeat(self):
         print('on_heartbeat')

stomp/transport.py

@@ -274,7 +274,7 @@ def transmit(self, frame):
         packed_frame = pack(lines)
 
         if log.isEnabledFor(logging.DEBUG):
-            log.debug("Sending frame: %s", lines)
+            log.debug("Sending frame: %s", utils.clean_lines(lines))
         else:
             log.info("Sending frame: %r", frame.cmd or "heartbeat")
         self.send(packed_frame)

stomp/utils.py

@@ -50,6 +50,11 @@
 #
 LINE_END_RE = re.compile('\n|\r\n')
 
+##
+# Used to replace the "passcode" to be dumped in the transport log (at debug level)
+#
+PASSCODE_RE = re.compile(r'\'passcode:[^\']*\'')
+
 ENC_NEWLINE = encode("\n")
 ENC_NULL = encode(NULL)
 
@@ -187,6 +192,11 @@ def clean_headers(headers):
     return rtn
 
 
+# lines: lines returned from a call to convert_frames
+def clean_lines(lines):
+    return re.sub(PASSCODE_RE, '\'passcode:********\\\\n\'', str(lines))
+
+
 def calculate_heartbeats(shb, chb):
     """
     Given a heartbeat string from the server, and a heartbeat tuple from the client,