feat: Sanitize request body (box/box-codegen#948)

Author: box-sdk-build

.codegen.json

@@ -1 +1 @@
-{ "engineHash": "2fabf30", "specHash": "576cd17", "version": "10.9.0" }
+{ "engineHash": "78a8dc0", "specHash": "576cd17", "version": "10.9.0" }

box_sdk_gen/box/errors.py

@@ -37,15 +37,24 @@ def __init__(
         url: str,
         query_params: Dict[str, str],
         headers: Dict[str, str],
-        body: Optional[str] = None,
+        body: Optional[Any] = None,
+        content_type: Optional[str] = None,
     ):
         self.method = method
         self.url = url
         self.query_params = query_params
         self.headers = headers
         self.body = body
+        self.content_type = content_type
 
     def print(self, data_sanitizer: DataSanitizer):
+        sanitized_body = (
+            data_sanitizer.sanitize_string_body(
+                self.body, content_type=self.content_type
+            )
+            if isinstance(self.body, str)
+            else self.body
+        )
         return ''.join(
             (
                 f'\n\tMethod: {self.method}',
@@ -55,8 +64,8 @@ def print(self, data_sanitizer: DataSanitizer):
                 ''.join(
                     [
                         '\n\tBody: ',
-                        '\n' if self.body else '',
-                        pprint.pformat(self.body, indent=8),
+                        '\n' if sanitized_body else '',
+                        pprint.pformat(sanitized_body, indent=8),
                     ]
                 ),
             )

box_sdk_gen/internal/logging.py

@@ -1,11 +1,19 @@
 from typing import Dict
 
+from typing import Optional
+
 from box_sdk_gen.serialization.json import SerializedData
 
 from box_sdk_gen.internal.utils import sanitize_map
 
 from box_sdk_gen.serialization.json import sanitize_serialized_data
 
+from box_sdk_gen.serialization.json import sanitize_form_encoded_body_from_string
+
+from box_sdk_gen.serialization.json import json_to_serialized_data
+
+from box_sdk_gen.serialization.json import sd_to_json
+
 
 class DataSanitizer:
     def __init__(self):
@@ -29,3 +37,21 @@ def sanitize_headers(self, headers: Dict[str, str]) -> Dict[str, str]:
 
     def sanitize_body(self, body: SerializedData) -> SerializedData:
         return sanitize_serialized_data(body, self._keys_to_sanitize)
+
+    def sanitize_form_encoded_body(self, body: str) -> str:
+        return sanitize_form_encoded_body_from_string(body, self._keys_to_sanitize)
+
+    def sanitize_string_body(
+        self, body: str, *, content_type: Optional[str] = None
+    ) -> str:
+        if (
+            content_type == 'application/json'
+            or content_type == 'application/json-patch+json'
+        ):
+            try:
+                return sd_to_json(self.sanitize_body(json_to_serialized_data(body)))
+            except Exception:
+                return body
+        if content_type == 'application/x-www-form-urlencoded':
+            return self.sanitize_form_encoded_body(body)
+        return body

box_sdk_gen/networking/box_network_client.py

@@ -40,6 +40,7 @@ class APIRequest:
     headers: Dict[str, str]
     params: Dict[str, str]
     data: Optional[Union[str, ByteStream, MultipartEncoder]]
+    content_type: Optional[str] = None
     allow_redirects: bool = True
     timeout: Optional[Tuple[Optional[float], Optional[float]]] = None
 
@@ -180,6 +181,7 @@ def _prepare_request(
             headers=headers,
             params=params,
             data=data,
+            content_type=options.content_type,
             allow_redirects=allow_redirects,
             timeout=timeout,
         )
@@ -304,6 +306,7 @@ def _raise_on_unsuccessful_request(
                 query_params=request.params,
                 headers=request.headers,
                 body=request.data,
+                content_type=request.content_type,
             ),
             response_info=ResponseInfo(
                 status_code=network_response.status_code,

box_sdk_gen/serialization/json.py

@@ -48,6 +48,32 @@ def sanitized_value() -> str:
     return '---[redacted]---'
 
 
+def sanitize_form_encoded_body_from_string(
+    body: str, keys_to_sanitize: Dict[str, str]
+) -> str:
+    return '&'.join(
+        [
+            _sanitize_form_encoded_parameter(parameter, keys_to_sanitize)
+            for parameter in body.split('&')
+        ]
+    )
+
+
+def _sanitize_form_encoded_parameter(
+    parameter: str, keys_to_sanitize: Dict[str, str]
+) -> str:
+    separator_index = parameter.find('=')
+    if separator_index < 0:
+        return parameter
+
+    key = parameter[:separator_index]
+    value = parameter[separator_index + 1 :]
+    sanitized_parameter_value = (
+        sanitized_value() if key.lower() in keys_to_sanitize else value
+    )
+    return f'{key}={sanitized_parameter_value}'
+
+
 def sanitize_serialized_data(
     sd: SerializedData, keys_to_sanitize: Dict[str, str]
 ) -> SerializedData:

test/box_network_client.py

@@ -338,6 +338,7 @@ def test_prepare_json_request(network_client, network_session_mock):
         },
         params={"param": "value"},
         data='{"key": "value"}',
+        content_type="application/json",
         timeout=(5, 60),
     )