Fix #1621: Do not crash when encountering unexpected data in the request

Author: matthiask

debug_toolbar/panels/request.py

@@ -26,9 +26,11 @@ def nav_subtitle(self):
     def generate_stats(self, request, response):
         self.record_stats(
             {
-                "get": get_sorted_request_variable(request.GET),
-                "post": get_sorted_request_variable(request.POST),
-                "cookies": get_sorted_request_variable(request.COOKIES),
+                "get": get_sorted_request_variable(request.GET, source="GET"),
+                "post": get_sorted_request_variable(request.POST, source="POST"),
+                "cookies": get_sorted_request_variable(
+                    request.COOKIES, source="COOKIES"
+                ),
             }
         )
 

debug_toolbar/utils.py

@@ -229,14 +229,17 @@ def getframeinfo(frame, context=1):
         return (filename, lineno, frame.f_code.co_name, lines, index)
 
 
-def get_sorted_request_variable(variable):
+def get_sorted_request_variable(variable, *, source):
     """
     Get a sorted list of variables from the request data.
     """
-    if isinstance(variable, dict):
-        return [(k, variable.get(k)) for k in sorted(variable)]
-    else:
-        return [(k, variable.getlist(k)) for k in sorted(variable)]
+    try:
+        if isinstance(variable, dict):
+            return [(k, variable.get(k)) for k in sorted(variable)]
+        else:
+            return [(k, variable.getlist(k)) for k in sorted(variable)]
+    except TypeError:
+        return [(f"<{source}>", variable)]
 
 
 def get_stack(context=1):

docs/changes.rst

@@ -3,6 +3,10 @@ Change log
 
 * Removed third party panels which have been archived on GitHub.
 * Added Django 4.1a1 to the CI matrix.
+* Stopped crashing when ``request.GET`` and ``request.POST`` are neither
+  dictionaries nor ``QueryDict`` instances. Using anything but ``QueryDict``
+  instances isn't a valid use of Django but, again, django-debug-toolbar
+  shouldn't crash.
 
 3.4.0 (2022-05-03)
 ------------------

tests/panels/test_request.py

@@ -85,6 +85,20 @@ def test_dict_for_request_in_method_post(self):
         self.assertIn("foo", content)
         self.assertIn("bar", content)
 
+    def test_list_for_request_in_method_post(self):
+        """
+        Verify that the toolbar doesn't crash if request.POST contains unexpected data.
+
+        See https://github.com/jazzband/django-debug-toolbar/issues/1621
+        """
+        self.request.POST = [{"a": 1}, {"b": 2}]
+        response = self.panel.process_request(self.request)
+        self.panel.generate_stats(self.request, response)
+        # ensure the panel POST request data is processed correctly.
+        content = self.panel.content
+        self.assertIn("<POST>", content)
+        self.assertIn("[{'a': 1}, {'b': 2}]", content)
+
     def test_namespaced_url(self):
         self.request.path = "/admin/login/"
         response = self.panel.process_request(self.request)