cleanupTextFromSecrets replaces words that are not secrets
- Dominant language
- Python
- Stars
- 5.5k
- Forks
- 1.7k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 6
Description
When using randomly generated words as password, the new secrets management system in BuildBot 9 will obfuscated words in logs that are not password, for example, if the password happens to be 'echo', the 'echo' in the command-line is obfuscated as well. This can be illustration using following unittest:
```
class TestInterpolateSecretsIncorrectObfuscation(unittest.TestCase):
def setUp(self):
self.master = fakemaster.make_master()
fakeStorageService = FakeSecretStorage()
fakeStorageService.reconfigService(secretdict={"foo": "echo",
"other": "value"})
self.secretsrv = SecretManager()
self.secretsrv.services = [fakeStorageService]
self.secretsrv.setServiceParent(self.master)
self.build = FakeBuildWithMaster(self.master)
@defer.inlineCallbacks
def test_secret(self):
command = Interpolate("echo %(secret:foo)s")
rendered = yield self.build.render(command)
cleantext = self.build.build_status.properties.cleanupTextFromSecrets(rendered)
self.assertEqual(cleantext, "echo ") # will fail as outcome is " "
```
I think using plain text search & replace for obfuscation is too naive, would be better to continue support the old obfuscating system in BuildBot 8?
Contributor guide
Assessment
This issue has not been assessed yet.