Settings panel: DjangoUnicodeDecodeError

[gvangool]

The SettingsPanel will force all values into a string, and for us some are just random bytes.

django-debug-toolbar/debug_toolbar/panels/settings.py

Lines 26 to 34 in 4e47b94

	def generate_stats(self, request, response):
	self.record_stats(
	{
	"settings": {
	key: force_str(value)
	for key, value in sorted(get_safe_settings().items())
	}
	}
	)

This is related to the new serialization work that landed #2138.

[matthiask]

Thanks for the report. That's a good point. Serializing isn't always safe. Do you have an example real-world value handy?

Checking the force_str function signature shows that we should probably be setting errors="ignore" or something like that: https://github.com/django/django/blob/6ea331907996a51842da55c1f8d65eea7b367c7d/django/utils/encoding.py#L53

[gvangool]

A little random, but something like this (and the env value is generated with xxd -g 2 -l 32 -c 0 -p /dev/urandom):

IMGPROXY_SALT = bytes.fromhex(
     ENV("IMGPROXY_SALT", default=b"imgproxy-salt-missing".hex())
)

I found a workaround by overriding SafeExceptionReporterFilter and marking the key as sensitive.

However having it not crash by default would be good, and ideally have it recurse into dict/list.
Because the values in debug-toolbar 5.2 for things like CACHES and DATABASES are a lot more readable.

[tim-schilling]

This may be fixed by #2169

[tim-schilling]

I was wrong.

This can be reproduced with the following change to tests/panels/test_settings.py:

@override_settings(DEBUG=True, RANDOM_SETTING=bytes.fromhex("a3f2b8c14e972d5a8fb3c7291a64e0859c472bf63d18a0945e73b2c84f917ae2"))
class SettingsIntegrationTestCase(IntegrationTestCase):
    def test_panel_title(self):

Since we have to iterate over the settings, it seems reasonable to catch the exception and use a placeholder value. That way, the toolbar is at least communicating that something was used for that setting. Reusing the cleansed value of ***** may not provide the same value as something like "Debug toolbar was unable to parse value".

That said, I can go with either skipping the setting, using the asterisks value or a separate parsing message.