buildbot / buildbot/buildbot

cleanupTextFromSecrets replaces words that are not secrets

Open
#3,750 10 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
5.5k
Forks
1.7k
Avg merge
2d 7h
Merged PRs (30d)
6

Description

When using randomly generated words as password, the new secrets management system in BuildBot 9 will obfuscated words in logs that are not password, for example, if the password happens to be 'echo', the 'echo' in the command-line is obfuscated as well. This can be illustration using following unittest:

```
class TestInterpolateSecretsIncorrectObfuscation(unittest.TestCase):
def setUp(self):
self.master = fakemaster.make_master()
fakeStorageService = FakeSecretStorage()
fakeStorageService.reconfigService(secretdict={"foo": "echo",
"other": "value"})
self.secretsrv = SecretManager()
self.secretsrv.services = [fakeStorageService]
self.secretsrv.setServiceParent(self.master)
self.build = FakeBuildWithMaster(self.master)

@defer.inlineCallbacks
def test_secret(self):
command = Interpolate("echo %(secret:foo)s")
rendered = yield self.build.render(command)
cleantext = self.build.build_status.properties.cleanupTextFromSecrets(rendered)
self.assertEqual(cleantext, "echo ") # will fail as outcome is " "
```

I think using plain text search & replace for obfuscation is too naive, would be better to continue support the old obfuscating system in BuildBot 8?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.