hashicorp / hashicorp/terraform-plugin-framework

Diagnostics.AddAttributeWarning does not redact value for attribute marked as sensitive

Open
#1,006 2 comments 1 reaction 1 assignee Claimed by @bflad View on GitHub
bug upstream-terraform
Dominant language
Go
Stars
384
Forks
107
Avg merge
3m
Merged PRs (30d)
1

Description

The warning message for an attribute that has been marked as "Sensitive" shows the value in the console.

I suspect similar misbehavior for error message?

### Module version

```
github.com/hashicorp/terraform-plugin-framework v1.8.0
```

### Relevant provider source code

```go
resp.Diagnostics.AddAttributeWarning(
req.Path,
"Usage of GPG can't be validated.",
"Due to limitations of go libraries, your GPG key can't be validated client side.",
)
```

### Terraform Configuration Files

N/A

### Debug Output

```console
│ Warning: Usage of GPG can't be validated.

│ with artifactory_keypair.some-keypair-6543461672124900137,
│ on cdk.tf.json line 2802, in resource.artifactory_keypair.some-keypair-6543461672124900137:
│ 2802: "private_key": "-----BEGIN PGP PRIVATE KEY BLOCK----- -----END PGP PRIVATE KEY BLOCK-----",

│ Due to limitations of go libraries, your GPG key can't be validated client
│ side.
```

### Expected Behavior

The value of the sensitive attribute should either be redacted or hidden completely.

### Actual Behavior

The value is output verbatim to the console.

### Steps to Reproduce

N/A

### References

Issue from practitioner: https://github.com/jfrog/terraform-provider-artifactory/issues/977

Source code: https://github.com/jfrog/terraform-provider-artifactory/blob/master/pkg/artifactory/resource/security/resource_artifactory_keypair.go#L114 and https://github.com/jfrog/terraform-provider-artifactory/blob/master/pkg/artifactory/resource/security/resource_artifactory_keypair.go#L284

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.