How can I selectively mask arbitrary data being sent over an insecure link?
Question: I'm using an offsite error logging package for my python web application. When
I send an error I include the contents of (among other things) the POST
variable and some template data. Some of this data must not be sent to the
error logging service (passwords, some other template data).

How can I take a payload that consists of a mix of data -- objects, dicts, et
al -- and mask out (say) every field or entry named `my_private_data`?

What I'd expect is that if an object has a string or integer property (the
private data will always be a number or a string) `my_private_data=SOME
SECRET`, it would be transmitted as `my_private_data=**********`

How do I accomplish this?


Answer: If you have the POST data as a string, you can use the standard modules
"urlparse" and "urllib" to remove certain parameters:

    
    
    import urlparse
    import urllib
    
    postDataAsDict = urlparse.parse_qs("a=5&b=3&c=%26escaped", strict_parsing = True)
    print postDataAsDict # prints {'a': ['5'], 'b': ['3'], 'c': ['&escaped']}
    
    del postDataAsDict["a"] # in your case "my_private_data"
    print urllib.urlencode(postDataAsDict, True) # prints c=%26escaped&b=3
    

Note that `parse_qs` correctly supports multiple parameters that have the same
name, so don't worry about that.

