aboutcode-org / aboutcode-org/python-inspector

Feature request: Mask repository credentials in --verbose output

Đang mở
#254 3 bình luận 4 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
Python
Star
23
Fork
28
Chỉ số merge pull request
Không có pull request nào được merge trong 30 ngày

Mô tả

# Summary

Currently, if command line flag `--verbose` is given, python-inspector outputs all repositories and their respective credentials, including username and **password** in **plain text**.

In order to reduce the risk of an adversary gaining access to the password, please add masking of passwords in the `printer` that prints the log output.

# Current behavior

When running python-inspector with `--verbose`, the tool prints information about all configured repositories, including:

* Repository URL or name
* Username
* Password in plain text

This means anyone with access to logs (local logs, CI logs, support dumps, etc.) can see the full password.

# Requested behaviour

When the `printer` outputs credentials in `--verbose` mode, apply the following masking rules to the password:

* If the password has a length of less than 12 characters, output only: `***`
* Else (password length ≥ 12), print: the first 3 characters of the password, then `***`, then the last 3 characters of the password.
Example: `abc***xyz`

The username and other non-secret fields can remain unchanged.

# Rationale

This feature would:
* Reduce the risk of leaking passwords to an acceptable level, because the full password is never printed.
* Still keep `--verbose` useful for support and maintenance: One can still verify whether the password used is the expected one by checking the visible prefix and suffix.

**To stress it again:**

Masking out the password **completely** would render the `--verbose` switch **useless for troubleshooting**.
The proposed partial masking (`abc***xyz`) keeps both security and usability in balance.

Hướng dẫn đóng góp

Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.