Sensitive attribute is not respected in shell_out when a timeout occurs
Open
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 133
- Forks
- 73
- Avg merge
- 8h 20m
- Merged PRs (30d)
- 2
Description
Description
The sensitive attribute does not work in a shell_out block when the command times out. This is very similar to issue chef/chef#7517
Chef Version
chef_version=14.12.3
Platform Version
platform=windows
platform_version=10.0.14393 (Windows Server 2016)
Replication Case
Create a recipe with the following code:
shell_out!('sleep 10; echo "my super secret"', timeout: 5, sensitive: true)
Client Output
Synchronizing Cookbooks:
- sensitive_test (0.1.0)
Installing Cookbook Gems:
Compiling Cookbooks...
================================================================================
Recipe Compile Error in C:/Users/ADMINI~1/AppData/Local/Temp/kitchen/cache/cookbooks/sensitive_test/recipes/default.rb
================================================================================
Mixlib::ShellOut::CommandTimeout
--------------------------------
command timed out:
Command execution failed. STDOUT/STDERR suppressed for sensitive resource
ProcessId: 2824
app_name: C:\Windows\system32\cmd.exe
command_line: cmd /c "sleep 10; echo "my super secret""
timeout: 5
System Info:
------------
chef_version=14.12.3
platform=windows
platform_version=10.0.14393
ruby=ruby 2.5.5p157 (2019-03-15 revision 67260) [x64-mingw32]
program_name=C:/opscode/chef/bin/chef-client
executable=C:/opscode/chef/bin/chef-client
Running handlers:
[2020-01-31T21:00:21+00:00] ERROR: Running exception handlers
Running handlers complete
[2020-01-31T21:00:21+00:00] ERROR: Exception handlers complete
Chef Client failed. 0 resources updated in 14 seconds
[2020-01-31T21:00:21+00:00] FATAL: Stacktrace dumped to C:/Users/ADMINI~1/AppData/Local/Temp/kitchen/cache/chef-stacktrace.out
[2020-01-31T21:00:21+00:00] FATAL: Please provide the contents of the stacktrace.out file if you file a bug report
[2020-01-31T21:00:21+00:00] FATAL: Mixlib::ShellOut::CommandTimeout: command timed out:
Command execution failed. STDOUT/STDERR suppressed for sensitive resource
ProcessId: 2824
app_name: C:\Windows\system32\cmd.exe
command_line: cmd /c "sleep 10; echo "my super secret""
timeout: 5
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the Windows timeout case using the shell_out! example with sensitive: true, then trace the timeout error path and its diagnostic output. Done means the timeout report does not expose the secret command or output while still identifying that the command timed out.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100