Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ModuleContext call in VerbService will return config/secrets/DSNs for any module #1319

Open
matt2e opened this issue Apr 23, 2024 · 0 comments
Open

ModuleContext call in VerbService will return config/secrets/DSNs for any module #1319

matt2e opened this issue Apr 23, 2024 · 0 comments
Labels
security relates to security (regardless of priority)

Comments

@matt2e
Copy link
Collaborator

matt2e commented Apr 23, 2024

This is a very sensitive payload (secrets!)
Anyone who can call these gRPC endpoints could retrieve all secrets for the system.
eg: code in a module could make a gRPC server to the FTL endpoint and ask for a different module's secrets.
@matt2e matt2e added the security relates to security (regardless of priority) label Apr 23, 2024
@github-actions github-actions bot added the triage Issue needs triaging label Apr 23, 2024
@alecthomas alecthomas mentioned this issue Apr 23, 2024
Open
@bradleydwyer bradleydwyer removed the triage Issue needs triaging label Apr 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
security relates to security (regardless of priority)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@bradleydwyer @matt2e