conductor-oss / conductor-oss/csharp-sdk

SecretResourceApi.PutSecret serializes string body as JSON, storing secrets with extra quotes

Open Beginner friendly
#165 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C#
Stars
54
Forks
23
Avg merge
4d 21h
Merged PRs (30d)
2

Description

## Summary

`PutSecret` / `PutSecretWithHttpInfo` stores secret values wrapped in extra JSON quotes (e.g. `VERY SECRET` is stored as `"VERY SECRET"`), making them unusable for authentication.

## Root cause

Two defects compound in `Conductor/Api/SecretResourceApi.cs` (`PutSecretWithHttpInfo`):

**1. Wrong Content-Type** (line ~718)
```csharp
String[] localVarHttpContentTypes = new String[] {
"application/json" // ← wrong
};
```
The server endpoint declares `consumes = {MediaType.TEXT_PLAIN_VALUE, MediaType.ALL_VALUE}`. It reads the body as raw bytes, not as JSON.

**2. String body is JSON-serialized** (line ~731-733)
```csharp
if (body != null && body.GetType() != typeof(byte[]))
{
localVarPostBody = this.Configuration.ApiClient.Serialize(body); // wraps string in JSON quotes
}
```
Because `string` is not `byte[]`, this branch always runs for `PutSecret`, JSON-encoding the value and adding surrounding double-quotes before it hits the wire.

The same pattern exists in `EnvironmentResourceApi` — some methods there already declare `text/plain` but still call `Serialize()`.

## Fix

In `PutSecretWithHttpInfo`:

```csharp
// Change content type
String[] localVarHttpContentTypes = new String[] {
"text/plain"
};

// Skip serialization — string body passed as-is
localVarPostBody = body;
```

## Workaround (until fixed)

Call the endpoint directly using `HttpClient`:

```csharp
var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-Authorization", yourToken);
var content = new StringContent("VERY SECRET", Encoding.UTF8, "text/plain");
await client.PutAsync("https://your-server/api/secrets/MY_KEY", content);
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in Conductor/Api/SecretResourceApi.cs at PutSecretWithHttpInfo and compare its request construction with the endpoint's text/plain contract. Check the related methods in EnvironmentResourceApi.cs for the same pattern, then verify that secret values are sent as raw text without extra quotes and that the request content type is text/plain.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.