actions / actions/actions-runner-controller
GH App private key can be printed to debug logs if one made mistake in helm values or intentionally removed every newline character in the pem file
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 6.5k
- Forks
- 1.5k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 27
Description
Describe the bug
When GitHub Client authentication fails the private key can end up being printed in full plain text form in debug logs.
Splitting the private key string by new line can be dangerous, consider a simple mistake of putting the content of the PEM file in github_app_private_key but with stripped new lines. We would end up with the entire key being printed in the debug logs.
Checks
- My actions-runner-controller version (v0.x.y) does support the feature
- I'm using an unreleased version of the controller I built from HEAD of the default branch
To Reproduce
Steps to reproduce the behavior:
- Create the controller-manager secret:
$ kubectl create secret generic controller-manager \
-n actions-runner-system \
--from-literal=github_app_id=app1337 \
--from-literal=github_app_installation_id=installation1338 \
--from-literal=github_app_private_key=THIS_IS_SECRET_NEVER_PRINT
- Use the above secret with actions-runner-controller and watch
THIS_IS_SECRET_NEVER_PRINTbeing printed in the pod debug logs
Error: Client creation failed. authentication failed: using private key of size 26 (THIS_IS_SECRET_NEVER_PRINT...): could not parse private key: Invalid Key: Key must be PEM encoded PKCS1 or PKCS8 private key
Expected behavior
Never print the App private key to debug. The hash of the string should be printed, or the string should be replaced by ***** literal.
Environment (please complete the following information):
- Controller Version [0.21.1]
- Deployment Method [Helm ]
- Helm Chart Version [0.16.1]
Additional context
Add any other context about the problem here.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the authentication failure in github/github.go and the debug logging path in main.go, then reproduce the malformed private-key case from the issue. Done means the private key is never included in debug output, including when the PEM value has no newlines; verify the resulting logs against the provided reproduction.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, helm, kubernetes
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100