Settings panel: DjangoUnicodeDecodeError

[gvangool]

The SettingsPanel will force all values into a string, and for us some are just random bytes.

django-debug-toolbar/debug_toolbar/panels/settings.py

Lines 26 to 34 in 4e47b94

	def generate_stats(self, request, response):
	self.record_stats(
	{
	"settings": {
	key: force_str(value)
	for key, value in sorted(get_safe_settings().items())
	}
	}
	)

This is related to the new serialization work that landed #2138.

[matthiask]

Thanks for the report. That's a good point. Serializing isn't always safe. Do you have an example real-world value handy?

Checking the force_str function signature shows that we should probably be setting errors="ignore" or something like that: https://github.com/django/django/blob/6ea331907996a51842da55c1f8d65eea7b367c7d/django/utils/encoding.py#L53

[gvangool]

A little random, but something like this (and the env value is generated with xxd -g 2 -l 32 -c 0 -p /dev/urandom):

IMGPROXY_SALT = bytes.fromhex(
     ENV("IMGPROXY_SALT", default=b"imgproxy-salt-missing".hex())
)

I found a workaround by overriding SafeExceptionReporterFilter and marking the key as sensitive.

However having it not crash by default would be good, and ideally have it recurse into dict/list.
Because the values in debug-toolbar 5.2 for things like CACHES and DATABASES are a lot more readable.