Fix #2317: Convert non-string keys in panels

- Add convert_keys_to_strings utility function
- Fix CachePanel to handle tuple and UUID keys
- Fix RequestPanel to safely handle POST data and convert session keys
- Add comprehensive tests for both panels
- All panel tests passing

Author: okiemute04

debug_toolbar/panels/cache.py

@@ -8,6 +8,8 @@
 
 from debug_toolbar.panels import Panel
 from debug_toolbar.utils import get_stack_trace, get_template_info, render_stacktrace
+from .utils import convert_keys_to_strings
+
 
 # The order of the methods in this list determines the order in which they are listed in
 # the Commands table in the panel content.
@@ -125,12 +127,16 @@ def _store_call_info(
 
         self.total_time += time_taken
         self.counts[name] += 1
+
+        converted_args = tuple(convert_keys_to_strings(arg) for arg in args)
+        converted_kwargs = {k: convert_keys_to_strings(v) for k, v in kwargs.items()}
+
         self.calls.append(
             {
                 "time": time_taken,
                 "name": name,
-                "args": args,
-                "kwargs": kwargs,
+                "args": converted_args,
+                "kwargs": converted_kwargs,
                 "trace": render_stacktrace(trace),
                 "template_info": template_info,
                 "backend": backend,

debug_toolbar/panels/request.py

@@ -4,6 +4,7 @@
 
 from debug_toolbar.panels import Panel
 from debug_toolbar.utils import get_name_from_obj, sanitize_and_sort_request_vars
+from .utils import convert_keys_to_strings
 
 
 class RequestPanel(Panel):
@@ -24,13 +25,25 @@ def nav_subtitle(self):
         return view_func.rsplit(".", 1)[-1]
 
     def generate_stats(self, request, response):
-        self.record_stats(
-            {
-                "get": sanitize_and_sort_request_vars(request.GET),
-                "post": sanitize_and_sort_request_vars(request.POST),
-                "cookies": sanitize_and_sort_request_vars(request.COOKIES),
-            }
-        )
+        get_data = convert_keys_to_strings(dict(request.GET))
+        try:
+            post_dict = dict(request.POST)
+        except (TypeError, ValueError):
+            post_dict = {'_raw_post_data': str(request.POST)}
+        post_data = convert_keys_to_strings(post_dict)
+        cookies_data = convert_keys_to_strings(dict(request.COOKIES))
+        
+        stats = {
+            "get": sanitize_and_sort_request_vars(get_data),
+            "post": sanitize_and_sort_request_vars(post_data),
+            "cookies": sanitize_and_sort_request_vars(cookies_data),
+        }
+        
+        if hasattr(request, "session"):
+            session_data = convert_keys_to_strings(dict(request.session))
+            stats["session"] = sanitize_and_sort_request_vars(session_data)
+        
+        self.record_stats(stats)
 
         view_info = {
             "view_func": _("<no view>"),
@@ -57,7 +70,3 @@ def generate_stats(self, request, response):
         except Http404:
             pass
         self.record_stats(view_info)
-
-        if hasattr(request, "session"):
-            session_data = dict(request.session)
-            self.record_stats({"session": sanitize_and_sort_request_vars(session_data)})

debug_toolbar/panels/utils.py

@@ -0,0 +1,32 @@
+def convert_keys_to_strings(obj):
+    """
+    Recursively convert non-string dictionary keys to strings.
+    
+    This ensures data is JSON-serializable before being passed to the store.
+    
+    Args:
+        obj: Any Python object (dict, list, tuple, or primitive)
+    
+    Returns:
+        Object with all dict keys converted to strings
+    """
+    from uuid import UUID
+    
+    
+    if isinstance(obj, dict):
+        result = {
+            str(k) if not isinstance(k, (str, int, float, bool, type(None))) else k:
+            convert_keys_to_strings(v)
+            for k, v in obj.items()
+        }
+        return result
+    elif isinstance(obj, tuple):
+        result = str(obj)
+        return result
+    elif isinstance(obj, UUID):
+        result = str(obj)
+        return result
+    elif isinstance(obj, list):
+        result = [convert_keys_to_strings(item) for item in obj]
+        return result
+    return obj

tests/panels/test_cache.py

@@ -158,3 +158,42 @@ def test_generate_server_timing(self):
     def test_backend_alias_is_recorded(self):
         cache.cache.get("foo")
         self.assertEqual(self.panel.calls[0]["backend"], "default (LocMemCache)")
+
+    def test_non_string_keys_are_converted(self):
+        """Test that non-string keys in cache operations are converted."""
+        from uuid import UUID
+        
+        
+        self.panel.calls = []
+        
+        
+        tuple_key = (1, 2)
+        cache.cache.set(tuple_key, "tuple_value")
+        
+        self.assertEqual(len(self.panel.calls), 1)
+        call = self.panel.calls[0]
+        self.assertEqual(call['name'], "set")
+        self.assertIsInstance(call['args'][0], str)
+        self.assertEqual(call['args'][0], "(1, 2)")
+        self.assertEqual(call['args'][1], "tuple_value")
+        
+       
+        uuid_key = UUID("aaaaaaaa-0000-0000-0000-000000000001")
+        cache.cache.set(uuid_key, "uuid_value")
+        
+        self.assertEqual(len(self.panel.calls), 2)
+        call = self.panel.calls[1]
+        self.assertEqual(call['name'], "set")
+        self.assertIsInstance(call['args'][0], str)
+        self.assertEqual(call['args'][0], "aaaaaaaa-0000-0000-0000-000000000001")
+        self.assertEqual(call['args'][1], "uuid_value")
+        
+        
+        cache.cache.get(tuple_key)
+        self.assertEqual(len(self.panel.calls), 3)
+        call = self.panel.calls[2]
+        self.assertEqual(call['name'], "get")
+        self.assertIsInstance(call['args'][0], str)
+        self.assertEqual(call['args'][0], "(1, 2)")
+
+    

tests/panels/test_request.py

@@ -9,8 +9,16 @@
 
 
 class RequestPanelTestCase(BaseTestCase):
+
     panel_id = RequestPanel.panel_id
 
+    def setUp(self):
+        super().setUp()
+        from django.contrib.sessions.middleware import SessionMiddleware
+        middleware = SessionMiddleware(lambda req: None)
+        middleware.process_request(self.request)
+        self.request.session.save()
+
     def test_non_ascii_session(self):
         self.request.session = {"où": "où"}
         response = self.panel.process_request(self.request)
@@ -121,23 +129,23 @@ def test_session_list_sorted_or_not(self):
             "data": ["foo", "bar", 1],
             (2, 3): "tuple_key",
         }
-        data = {
-            "list": [(1, "value"), ("data", ["foo", "bar", 1]), ((2, 3), "tuple_key")]
-        }
+        expected_data = {
+            "list": [(1, "value"), ("data", ["foo", "bar", 1]), ("(2, 3)", "tuple_key")]
+            }
         response = self.panel.process_request(self.request)
         self.panel.generate_stats(self.request, response)
         panel_stats = self.panel.get_stats()
-        self.assertEqual(panel_stats["session"], data)
+        self.assertEqual(panel_stats["session"], expected_data)
 
         self.request.session = {
             "b": "b-value",
             "a": "a-value",
         }
-        data = {"list": [("a", "a-value"), ("b", "b-value")]}
+        expected_data = {"list": [("a", "a-value"), ("b", "b-value")]}
         response = self.panel.process_request(self.request)
         self.panel.generate_stats(self.request, response)
         panel_stats = self.panel.get_stats()
-        self.assertEqual(panel_stats["session"], data)
+        self.assertEqual(panel_stats["session"], expected_data)
 
     def test_sensitive_post_data_sanitized(self):
         """Test that sensitive POST data is redacted."""
@@ -211,3 +219,62 @@ def test_querydict_sanitized(self):
         self.assertIn("token", content)
         self.assertNotIn("abc456", content)
         self.assertIn("********************", content)
+
+    def test_session_with_tuple_keys_are_converted(self):
+        """Test that session data with tuple keys is properly converted."""
+        
+        self.request.session["lookup"] = {(1, 2): "foo", (3, 4): "bar"}
+
+        response = self.panel.process_request(self.request)
+        self.panel.generate_stats(self.request, response)
+        stats = self.panel.get_stats()
+
+        
+        session = stats.get('session', {})
+        session_list = session.get('list', [])
+        
+       
+        lookup_data = None
+        for key, value in session_list:
+            if key == 'lookup':
+                lookup_data = value
+                break
+        
+        self.assertIsNotNone(lookup_data)
+        self.assertIn("(1, 2)", lookup_data)
+        self.assertIn("(3, 4)", lookup_data)
+        self.assertEqual(lookup_data["(1, 2)"], "foo")
+        self.assertEqual(lookup_data["(3, 4)"], "bar")
+
+    def test_nested_non_string_keys_are_converted(self):
+        """Test that deeply nested non-string keys are converted."""
+        
+        self.request.session["complex"] = {
+            (1, 2): {
+                (3, 4): ["value1", {"nested": (5, 6)}]
+            }
+        }
+
+        response = self.panel.process_request(self.request)
+        self.panel.generate_stats(self.request, response)
+        stats = self.panel.get_stats()
+
+        
+
+        session = stats.get('session', {})
+        session_list = session.get('list', [])
+        
+        complex_data = None
+        for key, value in session_list:
+            if key == 'complex':
+                complex_data = value
+                break
+        
+        self.assertIsNotNone(complex_data)
+        self.assertIn("(1, 2)", complex_data)
+        
+        nested = complex_data["(1, 2)"]
+        self.assertIn("(3, 4)", nested)
+        self.assertEqual(nested["(3, 4)"][0], "value1")
+        self.assertIn("nested", nested["(3, 4)"][1])
+        self.assertEqual(nested["(3, 4)"][1]["nested"], "(5, 6)")