apache / apache/openwhisk-wskdeploy
Obfuscate secrets when logging information in verbose mode
- Dominant language
- Go
- Stars
- 75
- Forks
- 73
- PR merge metrics
- No merged PRs in 30d
Description
When using wskdeploy in verbose mode (with the `-v` flag), it logs a lot of information, which is essential for debugging but also includes secret information.
This causes a security risk: developers may set the `-v` flag while debugging a CI script, which means secret information has now leaked into the log. They could remove the `-v` flag and change credentials once their script works but at some point, someone will forget. Conversely, developers debugging a script need to know that all important variables are set properly so something needs to be logged.
An approach I've seen somewhere else (I think it was Ansible but don't quote me on that) is to obfuscate secrets by only keeping the first and last characters, e.g. an auth key could be logged `626930...tEhDm5`: enough to know it's set correctly but not enough to leak the actual value.
Contributor guide
Assessment
This issue has not been assessed yet.