aboutcode-org / aboutcode-org/python-inspector

Feature request: Mask repository credentials in --verbose output

オープン
#254 コメント 3 件 リアクション 4 件 担当者 0 名 GitHub で見る
主要言語
Python
スター
23
フォーク
28
PR マージ指標
30日以内にマージされた PR はありません

説明

# Summary

Currently, if command line flag `--verbose` is given, python-inspector outputs all repositories and their respective credentials, including username and **password** in **plain text**.

In order to reduce the risk of an adversary gaining access to the password, please add masking of passwords in the `printer` that prints the log output.

# Current behavior

When running python-inspector with `--verbose`, the tool prints information about all configured repositories, including:

* Repository URL or name
* Username
* Password in plain text

This means anyone with access to logs (local logs, CI logs, support dumps, etc.) can see the full password.

# Requested behaviour

When the `printer` outputs credentials in `--verbose` mode, apply the following masking rules to the password:

* If the password has a length of less than 12 characters, output only: `***`
* Else (password length ≥ 12), print: the first 3 characters of the password, then `***`, then the last 3 characters of the password.
Example: `abc***xyz`

The username and other non-secret fields can remain unchanged.

# Rationale

This feature would:
* Reduce the risk of leaking passwords to an acceptable level, because the full password is never printed.
* Still keep `--verbose` useful for support and maintenance: One can still verify whether the password used is the expected one by checking the visible prefix and suffix.

**To stress it again:**

Masking out the password **completely** would render the `--verbose` switch **useless for troubleshooting**.
The proposed partial masking (`abc***xyz`) keeps both security and usability in balance.

コントリビューションガイド

このリポジトリのコントリビューションガイドは索引されていません

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。