OpenFn / OpenFn/adaptors

Errors in googlesheets adaptor leak credentials

Open
#1,706 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
24
Forks
41
Avg merge
3d 13h
Merged PRs (30d)
12

Description

When errors occur in the googlsheets adaptor, the logged error object includes a config object, which includes HTTP headers, which include the authorisation header.

{
  "message": "Invalid response body while trying to fetch https://sheets.googleapis.com/v4/spreadsheets/1s7K3kxzm5AlpwiALattyc7D9_aIyqWmo2ubcQIUlqlY/values/grm-DEPLOYED%21A%3AP: Premature close",
  "type": "system",
  "errno": "ERR_STREAM_PREMATURE_CLOSE",
  "code": "ERR_STREAM_PREMATURE_CLOSE",
  "config": {
    "url": "...",
    "method": "GET",
    "userAgentDirectives": [
      {
        "product": "google-api-nodejs-client",
        "version": "5.1.0",
        "comment": "gzip"
      }
    ],
    "headers": {
      "x-goog-api-client": "gdcl/5.1.0 gl-node/24.17.0 auth/7.14.1",
      "Accept-Encoding": "gzip",
      "User-Agent": "google-api-nodejs-client/5.1.0 (gzip)",
      "Authorization": "*****", // REDACTED!!!
      "Accept": "application/json"
    }
  }
}

I'm seeing this on an older version (3.0.14). So maybe this is fixed on latest.

This probably affects other google adaptors. I remember seeing this in googleapis while working on something else

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the error in the googlesheets adaptor on version 3.0.14 and compare its logged error object with the latest version. Inspect whether the config headers expose the Authorization value, then check other Google adaptors mentioned in the issue. Done means authentication credentials are no longer leaked in logged errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
google-cloud, javascript
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.