Sanitize request_id from inputs

Author: rabidpraxis

honeybadger/contrib/django.py

@@ -7,7 +7,12 @@
 
 from honeybadger import honeybadger
 from honeybadger.plugins import Plugin, default_plugin_manager
-from honeybadger.utils import filter_dict, filter_env_vars, get_duration
+from honeybadger.utils import (
+    filter_dict,
+    filter_env_vars,
+    get_duration,
+    sanitize_request_id,
+)
 from honeybadger.contrib.db import DBHoneybadger
 
 try:
@@ -160,6 +165,7 @@ def _set_request_id(self, request):
             or getattr(request, "request_id", None)
             or request.headers.get("X-Request-ID", None)
         )
+        request_id = sanitize_request_id(request_id)
         if not request_id:
             request_id = str(uuid.uuid4())
 

honeybadger/contrib/flask.py

@@ -12,6 +12,7 @@
     filter_env_vars,
     get_duration,
     extract_honeybadger_config,
+    sanitize_request_id,
 )
 from honeybadger.contrib.db import DBHoneybadger
 from six import iteritems
@@ -202,7 +203,7 @@ def _initialize_honeybadger(self, config):
     def _handle_request_started(self, sender, *args, **kwargs):
         from flask import request
 
-        request_id = request.headers.get("X-Request-ID")
+        request_id = sanitize_request_id(request.headers.get("X-Request-ID"))
         if not request_id:
             request_id = str(uuid.uuid4())
 

honeybadger/tests/test_utils.py

@@ -1,4 +1,4 @@
-from honeybadger.utils import filter_dict, filter_env_vars
+from honeybadger.utils import filter_dict, filter_env_vars, sanitize_request_id
 
 
 def test_filter_dict():
@@ -69,3 +69,14 @@ def test_filter_env_vars_with_non_dict():
 
 def test_filter_env_vars_empty_dict():
     assert filter_env_vars({}) == {}
+
+
+def test_sanitize_request_id():
+    assert sanitize_request_id("abc123-def456") == "abc123-def456"
+    assert sanitize_request_id("abc_123@def#456") == "abc123def456"
+    assert sanitize_request_id("a" * 300) == "a" * 255
+    assert sanitize_request_id("  abc123  ") == "abc123"
+    assert sanitize_request_id("@#$%^&*()") is None
+    assert sanitize_request_id(None) is None
+    assert sanitize_request_id("") is None
+    assert sanitize_request_id("   ") is None

honeybadger/utils.py

@@ -1,5 +1,6 @@
 import json
 import time
+import re
 
 
 class StringReprJSONEncoder(json.JSONEncoder):
@@ -87,3 +88,13 @@ def get_duration(start_time):
         return None
 
     return round((time.time() - start_time) * 1000, 4)
+
+
+def sanitize_request_id(request_id):
+    """Sanitize a Request ID by keeping only alphanumeric characters and hyphens."""
+    if not request_id:
+        return None
+
+    sanitized = re.sub(r"[^a-zA-Z0-9-]", "", request_id.strip())[:255]
+
+    return sanitized or None