Azure / Azure/azure-cli

Azure cli shows some of SecureString parameters in plain text

Open
#25,306 5 comments 0 reactions 1 assignee Claimed by @zhoxing-ms View on GitHub
act-identity-squad ARM Auto-Assign customer-reported feature-request Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Describe the bug**
Input parameters of type `@secured` in bicep template are accepted, but some of the secure string are displayed in plain text in the logs.

**To Reproduce**

- Define a bicep template for e.g. Azure Container App with secured parameters. For example:

```
@secure()
param storePassword string
@secure()
param clientSecret string
...

```

- Deploy the template with Azure CLI:
```
az deployment group create \
-g my-resource-group \
-n my-container-app \
--template-file my-container-app.bicep \
--parameters storePassword=$STORE_PASSWORD\
--parameters clientSecret=$CLIENT_SECRET \
...
--debug
```

- Then some of the secured parameters such as `clientSecret` are displayed in the logs.
`DEBUG: cli.knack.cli: Command arguments: ['deployment', 'group', 'create', '-g', 'my-resource-group', '-n', 'my-container-app', '--template-file', 'my-container-app.bicep', '--parameters', 'storePassword=[MASKED]', '--parameters', 'clientSecret=plain text of secret','--debug']`

**Expected behavior**
All secured string should be masked as follows:
`DEBUG: cli.knack.cli: Command arguments: ['deployment', 'group', 'create', '-g', 'my-resource-group', '-n', 'my-container-app', '--template-file', 'my-container-app.bicep', '--parameters', 'storePassword=[MASKED]', '--parameters', 'clientSecret=[MASKED]','--debug']
`

**Environment summary**
Azure CLI version 2.42.0 and 2.44.1

**Additional context**
The values of variables such as `$STORE_PASSWORD` or `$CLIENT_SECRET` come from gitlab ci/cd variables or from azure through azure cli. The plain text of secured string can also be displayed in other log statements such as:
```
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: {"properties" .....
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.