secrets for python actions capturable in cleartext using ps -ef | grep action_wrapper

SUMMARY

Python actions leak sensitive data when viewing processes

STACKSTORM VERSION

st2 3.7.0, on Python 3.8.13

OS, environment, install method

RHEL8, instance and mongoDB running on the same DL360 Proliant wtih 16 core / 64G RAM configuration

Steps to reproduce the problem

create sample flow:

name: secret_test
runner_type: python-script
description: secrettest
enabled: true
entry_point: secret_test.py
parameters:
  secret:
    type: string
    description: sample_secret
    required: false
    position: 0
    secret: true

with python script:

from st2common.runners.base_action import Action
import time

class SecretTest(Action):
    def run(self, secret):
        time.sleep(10)
        return(True)

run the flow and do ps -ef | grep action_wrapper:
[user@host ~]$ ps -ef | grep action_wrapper root 1540283 1421574 1 06:17 ? 00:00:00 /opt/stackstorm/virtualenvs/testing/bin/python -u /opt/stackstorm/st2/lib/python3.8/site-packages/python_runner/python_action_wrapper.py --pack=testing --file-path=/opt/stackstorm/internal_packs/testing/actions/secret_test.py --user=fdrab --parent-args=["--config-file","/etc/st2/st2.conf"] --parameters={"secret":"superSecretString"} --log-level=INFO user 1540289 1533819 0 06:17 pts/0 00:00:00 grep --color=auto action_wrapper [user@host ~]$

This leads to secrets being printed to the screen and easily captured even by a non-root user or anyone using ps -ef | grep. Secret is still properly masked in UI and does not appear in the logs.

Expected Results

I'd expect the secret parameters to be provided to the script in a secure way (even though I have no clue how).

Actual Results

secrets printed to console.

Reproduce the leak with the provided flow and ps -ef | grep action_wrapper, then inspect python_action_wrapper.py and its parameter handling. Done means secret parameters are no longer visible in process arguments to non-root users while the existing UI and log masking remains intact.