Repository: ucfopen/canvasapi

Issue:
Spaces in the API_KEY throw ValueError Exception
# Describe the bug

When the `API_KEY` passed to `Canvas` has a space character in the value, a `ValueError: too many values to unpack (expected 2)` exception is thrown.

# To Reproduce

Steps to reproduce the behavior:

1. Setup `API_URL` and `API_KEY` as normal.
2. Add an additional space character anywhere in the `API_KEY`
3. Setup Canvas object: `canvas = Canvas(API_URL, API_KEY)`
4. Make a call, e.g. `course = canvas.get_course(1)`

# Expected behavior

The whitespace should be automatically removed, or a more useful exception should be thrown.

# Environment information

- Python version (`python --version`)
3.7+
- CanvasAPI version (`pip show canvasapi`)
v0.14.0

# Additional context

```
Traceback (most recent call last):
  File "_test.py", line 42, in <module>
    course = canvas.get_course(COURSE_ID)
  File "<YANKED>canvasapi/canvas.py", line 603, in get_course
    "GET", uri_str.format(course_id), _kwargs=combine_kwargs(**kwargs)
  File "<YANKED>canvasapi/requester.py", line 191, in request
    "Headers: {headers}".format(headers=pformat(clean_headers(headers)))
  File "<YANKED>canvasapi/util.py", line 248, in clean_headers
    _, token = authorization_header.split(" ")
ValueError: too many values to unpack (expected 2)
```

Discussion:

Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5cde902..1973cf9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+### Bugfixes
+
+- Fixed an issue where `util.clean_headers()` would throw a `ValueError` if a user accidentally included a space in their API token. (Thanks, [@keeeeeegan](https://github.com/keeeeeegan))
+
 ## [0.14.0] - 2019-08-20
 
 ### New Endpoint Coverage
diff --git a/canvasapi/canvas.py b/canvasapi/canvas.py
index ec235a7..a574ccc 100644
--- a/canvasapi/canvas.py
+++ b/canvasapi/canvas.py
@@ -58,6 +58,11 @@ class Canvas(object):
                 UserWarning,
             )
 
+        # Ensure that the user-supplied access token contains no leading or
+        # trailing spaces that may cause issues when communicating with
+        # the API.
+        access_token = access_token.strip()
+
         base_url = new_url + "/api/v1/"
 
         self.__requester = Requester(base_url, access_token)
diff --git a/canvasapi/util.py b/canvasapi/util.py
index 976ecdd..5b23b3c 100644
--- a/canvasapi/util.py
+++ b/canvasapi/util.py
@@ -244,12 +244,7 @@ def clean_headers(headers):
 
     authorization_header = headers.get("Authorization")
     if authorization_header:
-        # Grab the actual token (not the "Bearer" prefix)
-        _, token = authorization_header.split(" ")
-
-        # Trim all but the last four characters
-        sanitized = "****" + token[-4:]
-
+        sanitized = "****" + authorization_header[-4:]
         cleaned_headers["Authorization"] = sanitized
 
     return cleaned_headers


Test patch:
diff --git a/tests/test_canvas.py b/tests/test_canvas.py
index 458759e..5170063 100644
--- a/tests/test_canvas.py
+++ b/tests/test_canvas.py
@@ -70,6 +70,10 @@ class TestCanvas(unittest.TestCase):
                 ),
             )
 
+    def test_init_strips_extra_spaces_in_api_key(self, m):
+        client = Canvas(settings.BASE_URL, " 12345 ")
+        self.assertEqual(client._Canvas__requester.access_token, "12345")
+
     # create_account()
     def test_create_account(self, m):
         register_uris({"account": ["create"]}, m)
diff --git a/tests/test_util.py b/tests/test_util.py
index e10972a..b530100 100644
--- a/tests/test_util.py
+++ b/tests/test_util.py
@@ -579,3 +579,9 @@ class TestUtil(unittest.TestCase):
 
         cleaned_headers = clean_headers(headers)
         self.assertIsNot(cleaned_headers, headers)
+
+    def test_clean_headers_strips_malformed_keys_correctly(self, m):
+        headers = {"Authorization": "Bearer  123,45"}
+
+        cleaned_headers = clean_headers(headers)
+        self.assertEqual(cleaned_headers["Authorization"], "****3,45")