influxdata / influxdata/ui

Notebook(Alerts): PagerDuty routing key stored in plain text in script

Open
#3,930 0 comments 0 reactions 0 assignees View on GitHub
area/notebooks bonitoo kind/bug severity/sev-4 team/automation team/ui team/unity
Dominant language
TypeScript
Stars
117
Forks
51
Avg merge
2d 15h
Merged PRs (30d)
4

Description

## About the bug

**Steps to reproduce:**
List the minimal actions needed to reproduce the behavior.

1. Setup a Pager Duty account and generate a routing key.
2. Go to Influxdbv2 UI (note that during this test the feature flag 'notebooksNewEndpoints' was set)
3. Add test data to a bucket
4. Create an Alert Notebook
5. Use the test data to define the query
6. In the alert section choose PagerDuty
7. Add a URL back to the notebook as Client URL
8. Add the routing key. Is masked like a password.
9. Click 'Export Alert Task'
10. Tasks > Open newly created task > Edit

**Expected behavior:**

Expected that sensitive value would be hashed or stored as a secret.

**Actual behavior:**

The routing key is stored in plain text.

**Visual Proof:**

![PagerDutyRoutingKeyUI01](https://user-images.githubusercontent.com/25881301/154970654-a0938fc5-26fb-458a-ad53-59e7846acdf8.png)

![PagerDutyFluxScript01](https://user-images.githubusercontent.com/25881301/154970693-b02d832d-e2da-4c41-9eb4-5b01e71d0cf7.png)

## About your environment

**Environment info:**

Testing in K8SIDPE remocal

latest commit project ui

```
commit 7f6a7997396b4cbae41cb300cafaac4306e73b56 (HEAD -> master, upstream/master, origin/master, origin/HEAD)
Author: wiedld
Date: Fri Feb 18 16:40:49 2022 -0800
```

latest commit project K8SIDPE

```
commit 39c95a0c4ff722649d49c14bef5eb5f5726afebf (HEAD -> master, origin/master, origin/alchemy/automatic, origin/HEAD)
Author: Hercules Mango Churchill
Date: Sat Feb 19 01:41:48 2022 +0000
```

Contributor guide

No contributing guide indexed for this repository

Research direction

No source files or tests are named. Start by reproducing the PagerDuty Alert Notebook flow through exporting and editing the alert task, then trace where the routing key is serialized; done means the exported or stored task no longer exposes the routing key in plain text and the behavior is covered by a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
frontend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.