crossplane / crossplane/upjet

`filterSensitiveInformation` fails to redact multiline values

Open
#612 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
481
Forks
131
Avg merge
2d 1h
Merged PRs (30d)
11

Description

### What happened?

`filterSensitiveInformation` fails to redact multiline string values (PEM private keys, passwords, certificates) from Terraform diagnostic output.

https://github.com/crossplane/upjet/blob/a4d9eb9abd6e7294382d483a60443374a6c14fa3/pkg/terraform/store.go#L327-L334

The filter value is the raw Go string however, Terraform's diagnostic output is JSON. The sensitive value goes through **two levels of JSON encoding** before reaching the filter:

1. upjet writes `ps.Configuration` to `main.tf.json` (1st encoding: real `\n` -> `\\n` in JSON source)
2. Terraform outputs diagnostics with `main.tf.json` content embedded in a `snippet.code` field (2nd encoding: `\\n` -> `\\\\n`)

The raw subprocess output therefore contains `\\n` where the filter value has `\n`. `strings.ReplaceAll` finds no match and the sensitive value is logged in plaintext.

### How can we reproduce it?

Using any upjet-based provider that puts a PEM private key in `ps.Configuration` e.g. [provider-okta](https://github.com/crossplane-contrib/provider-okta/blob/5ea000ffbafdec9deab7074188330d11b314ab91/internal/clients/okta.go#L101-L103)

**Expected:** all values in `ps.Configuration` appear as `REDACTED` in Terraform diagnostic log output.

**Actual:** `base_url`, `client_id`, `org_name` are redacted; `private_key` appears in plaintext in the `snippet.code` field of diagnostic output:

```
\\\"client_id\\\":\\\"REDACTED\\\",\\\"org_name\\\":\\\"REDACTED\\\",\\\"private_key\\\":\\\"-----BEGIN PRIVATE KEY-----\\\\n...
```

### References

- crossplane/upjet#280

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.