chef / chef/mixlib-shellout

Sensitive attribute is not respected in shell_out when a timeout occurs

Open
#201 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Ruby
Stars
133
Forks
73
Avg merge
8h 20m
Merged PRs (30d)
2

Description

Description

The sensitive attribute does not work in a shell_out block when the command times out. This is very similar to issue chef/chef#7517

Chef Version

chef_version=14.12.3

Platform Version

platform=windows
platform_version=10.0.14393 (Windows Server 2016)

Replication Case

Create a recipe with the following code:

shell_out!('sleep 10; echo "my super secret"', timeout: 5, sensitive: true)

Client Output

Synchronizing Cookbooks:
         - sensitive_test (0.1.0)
       Installing Cookbook Gems:
       Compiling Cookbooks...
       
       ================================================================================
       Recipe Compile Error in C:/Users/ADMINI~1/AppData/Local/Temp/kitchen/cache/cookbooks/sensitive_test/recipes/default.rb
       ================================================================================
       
       Mixlib::ShellOut::CommandTimeout
       --------------------------------
       command timed out:
       Command execution failed. STDOUT/STDERR suppressed for sensitive resource
       ProcessId: 2824
       app_name: C:\Windows\system32\cmd.exe
       command_line: cmd /c "sleep 10; echo "my super secret""
       timeout: 5
       
       System Info:
       ------------
       chef_version=14.12.3
       platform=windows
       platform_version=10.0.14393
       ruby=ruby 2.5.5p157 (2019-03-15 revision 67260) [x64-mingw32]
       program_name=C:/opscode/chef/bin/chef-client
       executable=C:/opscode/chef/bin/chef-client
       
       
       Running handlers:
       [2020-01-31T21:00:21+00:00] ERROR: Running exception handlers
       Running handlers complete
       [2020-01-31T21:00:21+00:00] ERROR: Exception handlers complete
       Chef Client failed. 0 resources updated in 14 seconds
       [2020-01-31T21:00:21+00:00] FATAL: Stacktrace dumped to C:/Users/ADMINI~1/AppData/Local/Temp/kitchen/cache/chef-stacktrace.out
       [2020-01-31T21:00:21+00:00] FATAL: Please provide the contents of the stacktrace.out file if you file a bug report
       [2020-01-31T21:00:21+00:00] FATAL: Mixlib::ShellOut::CommandTimeout: command timed out:
       Command execution failed. STDOUT/STDERR suppressed for sensitive resource
       ProcessId: 2824
       app_name: C:\Windows\system32\cmd.exe
       command_line: cmd /c "sleep 10; echo "my super secret""
       timeout: 5

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the Windows timeout case using the shell_out! example with sensitive: true, then trace the timeout error path and its diagnostic output. Done means the timeout report does not expose the secret command or output while still identifying that the command timed out.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
operating-systems, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.