Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

drone-cache expose some secrets in debug mode #140

Open
hacktron95 opened this issue Oct 9, 2020 · 4 comments
Open

drone-cache expose some secrets in debug mode #140

hacktron95 opened this issue Oct 9, 2020 · 4 comments
Labels
bug Something isn't working good first issue Good for newcomers hacktoberfest help wanted Extra attention is needed

Comments

@hacktron95
Copy link
Contributor

Describe the bug
Drone prints passed gcs.json-key secret in the logs when debug mode is enabled

To Reproduce
Steps to reproduce the behavior:

  1. using current version v1.1.0, I passed gcs.json-key as organization secret and enable debug mode.

Expected behavior

on debug mode or not, drone should never print a secret, and you will see in the screenshot that drone actually does this, it's only the json-key is printed.

Screenshots
image

Desktop (please complete the following information):

  • OS: x86_64 Linux 5.8.1-arch1-1
@hacktron95 hacktron95 changed the title drone prints some secrets in debug mode drone-cache expose some secrets in debug mode Oct 9, 2020
@kakkoyun
Copy link
Contributor

@hacktron95 Wow 😮 Thanks for catching this.

@kakkoyun kakkoyun added bug Something isn't working good first issue Good for newcomers hacktoberfest help wanted Extra attention is needed labels Oct 12, 2020
@hacktron95
Copy link
Contributor Author

@kakkoyun if you have a suggested approach, or you doubt something is causing this,
please let me know, I might be able to solve it.

@kakkoyun
Copy link
Contributor

@hacktron95 If could find an obfuscator that would be the easiest. Otherwise, other than blindly logging data we should just manually select what we log.

@apoorva-marisomaradhya
Copy link
Contributor

@hacktron95 Do you still see secrets printed in logs when debug mode is enabled?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working good first issue Good for newcomers hacktoberfest help wanted Extra attention is needed
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@kakkoyun @hacktron95 @apoorva-marisomaradhya