Repository: seanmonstar/reqwest (language: rust)

Issue:
[BUG] set_sensitive does not seem to work with RequestBuilder
Hi there!

I'm wanting to set a header value as sensitive, so that when I call `log::debug!` what is printed out is `"authorization": Sensitive`.

`set_sensitive` works perfectly if I set the value directly on the `ClientBuilder`, but if I set it through the `RequestBuilder` the value is not obscured.

I have created a couple of examples in the Rust playground to show the difference in output https://play.rust-lang.org/?version=stable&mode=debug&edition=2021&gist=2fdafa47dcef259f0768a2319d553b1f

Any help with this issue would be really appreciated!


Discussion / hints:

Fix patch:
diff --git a/src/async_impl/request.rs b/src/async_impl/request.rs
index 62744b36c..3a38aa4c3 100644
--- a/src/async_impl/request.rs
+++ b/src/async_impl/request.rs
@@ -203,7 +203,12 @@ impl RequestBuilder {
             match <HeaderName as TryFrom<K>>::try_from(key) {
                 Ok(key) => match <HeaderValue as TryFrom<V>>::try_from(value) {
                     Ok(mut value) => {
-                        value.set_sensitive(sensitive);
+                        // We want to potentially make an unsensitive header
+                        // to be sensitive, not the reverse. So, don't turn off
+                        // a previously sensitive header.
+                        if sensitive {
+                            value.set_sensitive(true);
+                        }
                         req.headers_mut().append(key, value);
                     }
                     Err(e) => error = Some(crate::error::builder(e.into())),
@@ -840,6 +845,25 @@ mod tests {
         assert!(req.headers()["authorization"].is_sensitive());
     }
 
+    #[test]
+    fn test_explicit_sensitive_header() {
+        let client = Client::new();
+        let some_url = "https://localhost/";
+
+        let mut header = http::HeaderValue::from_static("in plain sight");
+        header.set_sensitive(true);
+
+        let req = client
+            .get(some_url)
+            .header("hiding", header)
+            .build()
+            .expect("request build");
+
+        assert_eq!(req.url().as_str(), "https://localhost/");
+        assert_eq!(req.headers()["hiding"], "in plain sight");
+        assert!(req.headers()["hiding"].is_sensitive());
+    }
+
     #[test]
     fn convert_from_http_request() {
         let http_request = HttpRequest::builder()


Test patch: