make the censor function customizable

related to #530

Author: yanick

lib/Dancer2/Core/Error.pm

@@ -48,6 +48,27 @@ has title => (
     builder => '_build_title',
 );
 
+has censor => (
+	is => 'ro',
+	isa => CodeRef,
+	lazy => 1, 
+	default => sub {
+		my $self = shift;
+
+		my $custom = $self->has_app && $self->app->setting('error_censor') 
+            or return \&_censor;
+
+        my $module = $custom =~ s/::[^:]*?$//r;
+        my $function = $custom =~ s/^.*:://r;
+
+        require_module($module) unless eval { 
+            $module->can($function)
+        };
+
+        return $module->can($function);
+	}
+);
+
 sub _build_title {
     my ($self) = @_;
     my $title = 'Error ' . $self->status;
@@ -367,11 +388,11 @@ sub backtrace {
 }
 
 sub dumper {
-    my $obj = shift;
+    my ($self,$obj) = @_;
 
     # Take a copy of the data, so we can mask sensitive-looking stuff:
     my $data     = clone($obj);
-    my $censored = _censor( $data );
+    my $censored = $self->censor->( $data );
 
     #use Data::Dumper;
     my $dd = Data::Dumper->new( [ $data ] );
@@ -399,7 +420,7 @@ sub environment {
     my $env = $self->has_app && $self->app->has_request && $self->app->request->env;
 
     # Get a sanitised dump of the settings, session and environment
-    $_ = $_ ? dumper($_) : '<i>undefined</i>' for $settings, $session, $env;
+    $_ = $_ ? $self->dumper($_) : '<i>undefined</i>' for $settings, $session, $env;
 
     return <<"END_HTML";
 <div class="title">Stack</div><pre class="content">$stack</pre>
@@ -523,6 +544,35 @@ This is only an attribute getter, you'll have to set it at C<new>.
 
 The message of the error page.
 
+=attr censor 
+
+The function to use to censor error messages. By default it uses the 
+C<_censor> function of this package, but it can be configured via the 
+app setting 'error_censor'. If provided, C<error_censor> has to be 
+the fully qualified name of the censor function to use. That function is 
+expected to take in the data as a hashref, modify it in place and return 
+the number of items 'censored'.
+
+For example, using L<Data::Censor>.
+
+	# in config.yml
+	error_censor: MyApp::Censor::censor
+
+	# in MyApp::Censor
+	package MyApp::Censor;
+
+	use Data::Censor;
+
+	my $data_censor = Data::Censor->new(
+		sensitive_fields => [ qw(card_number password hush) ],
+		replacement => '(Sensitive data hidden)',
+	);
+
+	sub censor { $data_censor->censor(@_) }
+
+	1;
+
+
 =method throw($response)
 
 Populates the content of the response with the error's information.

t/error.t

@@ -1,5 +1,8 @@
 use strict;
 use warnings;
+
+use lib 't/lib';
+
 use Test::More import => ['!pass'];
 use Plack::Test;
 use HTTP::Request::Common;
@@ -37,6 +40,7 @@ my $request = $app->build_request($env);
 
 $app->set_request($request);
 
+
 subtest 'basic defaults of Error object' => sub {
     my $err = Dancer2::Core::Error->new( app => $app );
     is $err->status,  500,                                 'code';
@@ -240,8 +244,47 @@ subtest 'Errors with show_stacktrace and circular references' => sub {
         'Values for other keys (non-sensitive) appear in the stacktrace');
 };
 
-done_testing;
+subtest censor => sub {
+	sub MyApp::Censor::censor { $_[0]->{hush} = 'NOT TELLING'; return 1; }
+
+	my $app = Dancer2::Core::App->new( name => 'main' );
+
+	$app->setting( password => 'potato' ); # oh my, we're leaking a password
+
+	subtest 'core censor()' => sub {
+		my $error = Dancer2::Core::Error->new( app => $app );
+
+		unlike $error->environment => qr/potato/, 'the password is censored';
+		like $error->environment => qr/^.*password.*Hidden.*$/m, 'we say it is hidden';
+	};
+
+	subtest 'custom censor()' => sub {
+		my $app = Dancer2::Core::App->new( name => 'main' );
+		my $error = Dancer2::Core::Error->new( app => $app );
+
+		$app->setting( hush => 'potato' ); 
 
+		$app->setting( error_censor => 'MyApp::Censor::censor' );
+
+		unlike $error->environment => qr/potato/, 'the password is censored';
+		like $error->environment => qr/^ .* hush .* NOT \s TELLING .* $/xm, 'we say it is hidden';
+	};
+
+	subtest 'custom imported censor()' => sub {
+		my $app = Dancer2::Core::App->new( name => 'main' );
+		my $error = Dancer2::Core::Error->new( app => $app );
+
+		$app->setting( personal => 'potato' ); 
+
+		$app->setting( error_censor => 'CustomCensor::censor' );
+
+		unlike $error->environment => qr/potato/, 'the password is censored';
+		like $error->environment => qr/^ .* personal .* for \s my \s eyes \s only .* $/xm, 'we say it is hidden';
+	};
+
+};
+
+done_testing;
 
 {   # Simple test exception class
     package MyTestException;

t/lib/CustomCensor.pm

@@ -0,0 +1,11 @@
+package CustomCensor;
+
+sub censor {
+    my $data = shift;
+
+    $data->{personal} = 'for my eyes only';
+
+    return 1;
+}
+
+1;