Azure / Azure/azure-cli

az command leaking data which is marked as secret in the swagger

Open
#27,547 3 comments 0 reactions 0 assignees View on GitHub
Auto-Resolve bug Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

### Describe the bug

`az` command is not masking the user provided password.

### Related command

`az connectedvmware vcenter connect`

### Errors

NIL

### Issue script & Debug output

```
$ az connectedvmware vcenter connect --debug -g snaskar-rg -l
northeurope -c /subscriptions/204898ee-cd13-4332-b9d4-55ca5c25496d/resourceGroups/snaskar-rg/providers/Microsoft.ExtendedLocation/customLocations/snaskar-vmware-special-char-cl --name snaskar-vmware-special-char-vc --fqdn arcvmw-vcen80.fareast.corp.microsoft.com

...
cli.azure.cli.core.sdk.policies: Request method: 'PUT' [0/2969]
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json'
cli.azure.cli.core.sdk.policies: 'Content-Length': '408'
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '672763f3-6679-11ee-a038-c195d7941ead'
cli.azure.cli.core.sdk.policies: 'CommandName': 'connectedvmware vcenter connect'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--debug -g -l -c --name --fqdn --username --password' cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.52.0 azsdk-python-mgmt-connectedvmware/1.0.0b1 Python
/3.8.10 (Linux-5.15.0-78-generic-x86_64-with-glibc2.29)'
cli.azure.cli.core.sdk.policies: 'Authorization': '*****'
cli.azure.cli.core.sdk.policies: Request body: cli.azure.cli.core.sdk.policies: {"location": "northeurope", "extendedLocation": {"type": "CustomLocation", "name": "/subscriptions/204898ee-cd13-4332-b9d4-55ca5c25496d/resourceGroups/snaskar-rg/providers/Microsoft.ExtendedLocation/customLocations/snaskar-vmware-special-char-cl"}, "properties": {"fqdn": "arcvmw-vcen80.fareast.corp.microsoft.com",
"credentials": {"username": "vsphere.local\\svc_arcbridge", "password": "superstringpass"}}}
```

### Expected behavior

The secret value should be masked from the response body.. we can make changes in autorest / knack, or whichever library suits best to hide a field which contains sensitive info.

### Environment Summary

azure-cli 2.52.0 *
core 2.52.0 *
telemetry 1.1.0

Extensions:
arcappliance 1.0.0
connectedk8s 1.4.0
connectedmachine 0.6.0
connectedvmware 0.2.1
customlocation 0.1.3
k8s-extension 1.4.5
resource-graph 2.1.0
scvmm 0.1.8
connectedvmware 0.1.8 (dev) /home/arcvmware/Code/ms/azure/cli/azure-cli-extensions/src/connectedv
mware
scvmm 0.1.6 (dev) /home/arcvmware/Code/ms/azure/cli/azure-cli-extensions/src/scvmm

Dependencies:
msal 1.24.0b1
azure-mgmt-resource 23.1.0b2

Python location '/home/arcvmware/lib/azure-cli/bin/python'
Extensions directory '/home/arcvmware/.azure/cliextensions'
Development extension sources:
/home/arcvmware/Code/ms/azure/cli/azure-cli-extensions

Python (Linux) 3.8.10 (default, May 26 2023, 14:05:08)
[GCC 9.4.0]

Legal docs and information: aka.ms/AzureCliLegal

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.