LA Consumption run history inputs not always sanitizing the Bearer token
- Dominant language
- TypeScript
- Stars
- 111
- Forks
- 109
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 20
Description
### Severity
P2 - High (Major functionality broken)
### Describe the Bug with repro steps
Expected Behavior
When using Authorization Bearer token in the Header of HTTP action in LA consumption and looking into the Run history inputs the bearer token would need to be always sanitized.
Actual Behavior
For some HTTP Actions using the Bearer token in the Authorization Header the Token coming from previous action value is not sanitized and it is visible in the inputs of the action in a particular run.
### What type of Logic App Is this happening in?
Consumption (Portal)
### Are you experiencing a regression?
_No response_
### Which operating system are you using?
Windows
### Did you refer to the TSG before filing this issue? https://aka.ms/lauxtsg
Yes
### Workflow JSON
```json
```
### Screenshots or Videos
_No response_
### Environment
Browser: All
### Additional context
_No response_
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in the Consumption Portal by reproducing an HTTP action that uses an Authorization Bearer token supplied by a previous action, then inspect that action's run history inputs. Done means the token is consistently sanitized and never visible in the inputs for any affected HTTP action.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react, typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100