conductor-oss / conductor-oss/csharp-sdk
SecretResourceApi.PutSecret serializes string body as JSON, storing secrets with extra quotes
- Dominant language
- C#
- Stars
- 54
- Forks
- 23
- Avg merge
- 4d 21h
- Merged PRs (30d)
- 2
Description
## Summary
`PutSecret` / `PutSecretWithHttpInfo` stores secret values wrapped in extra JSON quotes (e.g. `VERY SECRET` is stored as `"VERY SECRET"`), making them unusable for authentication.
## Root cause
Two defects compound in `Conductor/Api/SecretResourceApi.cs` (`PutSecretWithHttpInfo`):
**1. Wrong Content-Type** (line ~718)
```csharp
String[] localVarHttpContentTypes = new String[] {
"application/json" // ← wrong
};
```
The server endpoint declares `consumes = {MediaType.TEXT_PLAIN_VALUE, MediaType.ALL_VALUE}`. It reads the body as raw bytes, not as JSON.
**2. String body is JSON-serialized** (line ~731-733)
```csharp
if (body != null && body.GetType() != typeof(byte[]))
{
localVarPostBody = this.Configuration.ApiClient.Serialize(body); // wraps string in JSON quotes
}
```
Because `string` is not `byte[]`, this branch always runs for `PutSecret`, JSON-encoding the value and adding surrounding double-quotes before it hits the wire.
The same pattern exists in `EnvironmentResourceApi` — some methods there already declare `text/plain` but still call `Serialize()`.
## Fix
In `PutSecretWithHttpInfo`:
```csharp
// Change content type
String[] localVarHttpContentTypes = new String[] {
"text/plain"
};
// Skip serialization — string body passed as-is
localVarPostBody = body;
```
## Workaround (until fixed)
Call the endpoint directly using `HttpClient`:
```csharp
var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-Authorization", yourToken);
var content = new StringContent("VERY SECRET", Encoding.UTF8, "text/plain");
await client.PutAsync("https://your-server/api/secrets/MY_KEY", content);
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in Conductor/Api/SecretResourceApi.cs at PutSecretWithHttpInfo and compare its request construction with the endpoint's text/plain contract. Check the related methods in EnvironmentResourceApi.cs for the same pattern, then verify that secret values are sent as raw text without extra quotes and that the request content type is text/plain.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- api
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100