actions / actions/actions-runner-controller

GH App private key can be printed to debug logs if one made mistake in helm values or intentionally removed every newline character in the pem file

Open
#1,187 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement help wanted
Dominant language
Go
Stars
6.5k
Forks
1.5k
Avg merge
2d 2h
Merged PRs (30d)
27

Description

Describe the bug
When GitHub Client authentication fails the private key can end up being printed in full plain text form in debug logs.

Splitting the private key string by new line can be dangerous, consider a simple mistake of putting the content of the PEM file in github_app_private_key but with stripped new lines. We would end up with the entire key being printed in the debug logs.

Checks

  • My actions-runner-controller version (v0.x.y) does support the feature
  • I'm using an unreleased version of the controller I built from HEAD of the default branch

To Reproduce
Steps to reproduce the behavior:

  1. Create the controller-manager secret:
$ kubectl create secret generic controller-manager \
    -n actions-runner-system \
    --from-literal=github_app_id=app1337 \
    --from-literal=github_app_installation_id=installation1338 \
    --from-literal=github_app_private_key=THIS_IS_SECRET_NEVER_PRINT
  1. Use the above secret with actions-runner-controller and watch THIS_IS_SECRET_NEVER_PRINT being printed in the pod debug logs
Error: Client creation failed. authentication failed: using private key of size 26 (THIS_IS_SECRET_NEVER_PRINT...): could not parse private key: Invalid Key: Key must be PEM encoded PKCS1 or PKCS8 private key

Expected behavior
Never print the App private key to debug. The hash of the string should be printed, or the string should be replaced by ***** literal.

Environment (please complete the following information):

  • Controller Version [0.21.1]
  • Deployment Method [Helm ]
  • Helm Chart Version [0.16.1]

Additional context
Add any other context about the problem here.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the authentication failure in github/github.go and the debug logging path in main.go, then reproduce the malformed private-key case from the issue. Done means the private key is never included in debug output, including when the PEM value has no newlines; verify the resulting logs against the provided reproduction.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, helm, kubernetes
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.