Elgato_dark/argo-cd
1
0
Fork 0
mirror of https://github.com/argoproj/argo-cd synced 2026-05-23 01:08:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

Hide bindPW in dex config (#3025)

Browse source 
Like https://github.com/argoproj/argo-cd/issues/2536 , the DEX password for LDAP is being leaked in a command that prints configuration.
This change not only hides the bindPW but also changes the logging level to trace so that by default, the configuration is not leaked to logs.
This commit is contained in:
Dário Nascimento 2020-01-25 03:37:14 +11:00 committed by Alexander Matyushentsev
parent 17d217c2d6
commit 4cf02fd813
2 changed files with 16 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
cmd/argocd-util/main.go
View file

@ -109,7 +109,7 @@ func NewRunDexCommand() *cobra.Command {
} else {
err = ioutil.WriteFile("/tmp/dex.yaml", dexCfgBytes, 0644)
errors.CheckError(err)
log.Info(redactor(string(dexCfgBytes)))
log.Debug(redactor(string(dexCfgBytes)))
cmd = exec.Command("dex", "serve", "/tmp/dex.yaml")
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
@ -640,7 +640,7 @@ func redactor(dirtyString string) string {
err := yaml.Unmarshal([]byte(dirtyString), &config)
errors.CheckError(err)
iterateStringFields(config, func(name string, val string) string {
if name == "clientSecret" || name == "secret" {
if name == "clientSecret" || name == "secret" || name == "bindPW" {
return "********"
} else {
return val

14
cmd/argocd-util/main_test.go
View file

@ -18,6 +18,13 @@ connectors:
id: github
name: GitHub
type: github
- config:
bindDN: uid=serviceaccount,cn=users,dc=example,dc=com
bindPW: theSecret
host: ldap.example.com:636
id: ldap
name: LDAP
type: ldap
grpc:
addr: 0.0.0.0:5557
issuer: https://argocd.example.com/api/dex
@ -49,6 +56,13 @@ var expectedRedaction = `connectors:
id: github
name: GitHub
type: github
- config:
bindDN: uid=serviceaccount,cn=users,dc=example,dc=com
bindPW: '********'
host: ldap.example.com:636
id: ldap
name: LDAP
type: ldap
grpc:
addr: 0.0.0.0:5557
issuer: https://argocd.example.com/api/dex