StackStorm / StackStorm/st2

Stackstorm UI not masking the secret values

Open
#6,272 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
6.5k
Forks
787
PR merge metrics
No merged PRs in 30d

Description

SUMMARY

Provide a quick summary of your bug report.
The API and Logs have the option to mask the secrets but the execution history in the GUI is showing the secrets in plain text

STACKSTORM VERSION

Paste the output of st2 --version:
st2 3.8.1, on Python 3.8.10

OS, environment, install method

Ubuntu, Docker

Post what OS you are running this on, along with any other relevant information/

  • e.g. Docker, Vagrant, Kubernetes, etc. Describe how you installed ST2
  • e.g. one-line install, custom install, etc -->

Steps to reproduce the problem

st2 key set github_key test-value --encrypt

GUI:
Actions -> Packs -> download
Packs:
https://:{{ st2kv.system.github_key | decrypt_kv }}@

CLI
st2 pack install https://:{{ st2kv.system.github_key | decrypt_kv }}@

Show how to reproduce the problem, using a minimal test-case. Make sure to include any content
(pack content - workflows, actions, etc.) which are needed to reproduce the problem.

Expected Results

What did you expect to happen when running the steps above?
https://:******@

Actual Results

cmdline: git clone -v -- https://:@
But GUI is showing the key in plain text
What happened? What output did you get?

Making sure to follow these steps will guarantee the quickest resolution possible.

Thanks!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the report through the GUI path Actions → Packs → download with the encrypted github_key example, then compare its execution history with the CLI output. Done means the GUI execution history masks the secret value consistently with the expected and command-line results.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
frontend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.