mask the API key in the error chained to an API error

Author: jjsaunier

CHANGELOG.md

@@ -30,6 +30,8 @@
 - A connection error no longer prints the API key: requests put the request URL, `key` included, in its message
   and in the urllib3 errors chained to it, and an `HTTPError` from an error status printed it too. The key now
   reads `key=REDACTED`.
+- An API error raised from an error status no longer chains the `HTTPError` it came from, whose URL carries the API
+  key: a traceback, `logger.exception` or Sentry printed the key. The chained error reads `key=REDACTED`.
 - `ScrapflySpider` crawls again on Scrapy 2.16 and later: it now defines `start()`, which Scrapy reads in place
   of `start_requests()` (Scrapy 2.19 no longer calls `start_requests()` at all).
 - The Scrapy integration emits no deprecation warning from Scrapy 2.11 to 2.19: the middlewares no longer

scrapfly/api_response.py

@@ -33,6 +33,7 @@
     ApiHttpServerError, UpstreamHttpError, HttpError, \
     ExtraUsageForbidden, WebhookSignatureMissMatch, ContentError, api_error_args
 from .frozen_dict import FrozenDict
+from .transport import without_key
 
 logger = logging.getLogger(__name__)
 
@@ -452,13 +453,13 @@ def raise_for_result(
                 args.update(request=e.request, response=e.response, api_response=self)
 
                 if e.response.status_code >= 500:
-                    raise ApiHttpServerError(**args) from e
+                    raise ApiHttpServerError(**args) from without_key(e)
 
                 # respect raise_on_upstream_error with screenshot and extraction only
                 if error_class in (ScreenshotAPIError, ExtractionAPIError) and not raise_on_upstream_error:
                     return
 
-                raise error_class(**args) from e
+                raise error_class(**args) from without_key(e)
 
 
 class LargeObjectApiResponse(ApiResponse):

tests/test_clients.py

@@ -3,6 +3,7 @@
 import gzip
 import inspect
 import json
+import traceback
 from io import BytesIO
 from dataclasses import dataclass
 from typing import Callable, Dict, List, Tuple
@@ -267,7 +268,8 @@ async def scenario(scrapfly):
     with pytest.raises(error) as raised:
         run(kind, server, scenario)
 
-    assert KEY not in str(raised.value)
+    # A traceback prints the chained causes too, as Sentry and logger.exception do.
+    assert KEY not in ''.join(traceback.format_exception(raised.value))
 
 
 @pytest.mark.parametrize('content_encoding,body,expected', [