`filterSensitiveInformation` fails to redact multiline values
- Dominant language
- Go
- Stars
- 481
- Forks
- 131
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 11
Description
### What happened?
`filterSensitiveInformation` fails to redact multiline string values (PEM private keys, passwords, certificates) from Terraform diagnostic output.
https://github.com/crossplane/upjet/blob/a4d9eb9abd6e7294382d483a60443374a6c14fa3/pkg/terraform/store.go#L327-L334
The filter value is the raw Go string however, Terraform's diagnostic output is JSON. The sensitive value goes through **two levels of JSON encoding** before reaching the filter:
1. upjet writes `ps.Configuration` to `main.tf.json` (1st encoding: real `\n` -> `\\n` in JSON source)
2. Terraform outputs diagnostics with `main.tf.json` content embedded in a `snippet.code` field (2nd encoding: `\\n` -> `\\\\n`)
The raw subprocess output therefore contains `\\n` where the filter value has `\n`. `strings.ReplaceAll` finds no match and the sensitive value is logged in plaintext.
### How can we reproduce it?
Using any upjet-based provider that puts a PEM private key in `ps.Configuration` e.g. [provider-okta](https://github.com/crossplane-contrib/provider-okta/blob/5ea000ffbafdec9deab7074188330d11b314ab91/internal/clients/okta.go#L101-L103)
**Expected:** all values in `ps.Configuration` appear as `REDACTED` in Terraform diagnostic log output.
**Actual:** `base_url`, `client_id`, `org_name` are redacted; `private_key` appears in plaintext in the `snippet.code` field of diagnostic output:
```
\\\"client_id\\\":\\\"REDACTED\\\",\\\"org_name\\\":\\\"REDACTED\\\",\\\"private_key\\\":\\\"-----BEGIN PRIVATE KEY-----\\\\n...
```
### References
- crossplane/upjet#280
Contributor guide
Assessment
This issue has not been assessed yet.