az keyvault secret set exposes value
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
It came to my attention (via a question I got from a colleague) that `az keyvault secret set` bluntly prints the secret value in **cleartext** to the output of the command (even if the secret was read from a file!).
I am aware this is a duplicate of #20858. The reason I am opening this issue anyway is that the suggestion there was to simply suppress the output of the command (via e.g. `--output none`) while the Key Vault API is being changed to no longer return the secret in its responses.
It is now more than half a year later, and the issue still occurs. Since printing a secret value in cleartext to stdout by default is a **big** violation of the Principle Of Least Astonishment, and it comes with a possibly significant security impact, I think it is warranted to introduce a workaround in Azure CLI so that it no longer prints the cleartext value of the secret.
Yes, changing the Key Vault API would also (and arguably better) solve this problem, but it is a design decision of Azure CLI to just dump the output of the response it gets to its API calls to stdout. Which means I think at least some of the responsibility is with Azure CLI to prevent this from happening.
Contributor guide
Assessment
This issue has not been assessed yet.