Errors in googlesheets adaptor leak credentials
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 24
- Forks
- 41
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 12
Description
When errors occur in the googlsheets adaptor, the logged error object includes a config object, which includes HTTP headers, which include the authorisation header.
{
"message": "Invalid response body while trying to fetch https://sheets.googleapis.com/v4/spreadsheets/1s7K3kxzm5AlpwiALattyc7D9_aIyqWmo2ubcQIUlqlY/values/grm-DEPLOYED%21A%3AP: Premature close",
"type": "system",
"errno": "ERR_STREAM_PREMATURE_CLOSE",
"code": "ERR_STREAM_PREMATURE_CLOSE",
"config": {
"url": "...",
"method": "GET",
"userAgentDirectives": [
{
"product": "google-api-nodejs-client",
"version": "5.1.0",
"comment": "gzip"
}
],
"headers": {
"x-goog-api-client": "gdcl/5.1.0 gl-node/24.17.0 auth/7.14.1",
"Accept-Encoding": "gzip",
"User-Agent": "google-api-nodejs-client/5.1.0 (gzip)",
"Authorization": "*****", // REDACTED!!!
"Accept": "application/json"
}
}
}
I'm seeing this on an older version (3.0.14). So maybe this is fixed on latest.
This probably affects other google adaptors. I remember seeing this in googleapis while working on something else
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the error in the googlesheets adaptor on version 3.0.14 and compare its logged error object with the latest version. Inspect whether the config headers expose the Authorization value, then check other Google adaptors mentioned in the issue. Done means authentication credentials are no longer leaked in logged errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- google-cloud, javascript
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100