Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Git credentials are exposed in atlantis logs #4060

Open
1 task
nnovaeshc opened this issue Dec 15, 2023 · 2 comments 路 May be fixed by #4667
Open
1 task

Git credentials are exposed in atlantis logs #4060

nnovaeshc opened this issue Dec 15, 2023 · 2 comments 路 May be fixed by #4667
Labels
feature New functionality/enhancement security

Comments

@nnovaeshc
Copy link

Community Note

  • Please vote on this issue by adding a 馃憤 reaction to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
  • Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
  • If you are interested in working on this issue or have submitted a pull request, please leave a comment.

Describe the user story
Git credentials are exposed in atlantis logs (at least) when --write-git-creds. Even though there's a warning in atlantis documentation stating "This does write secrets to disk and should only be enabled in a secure environment.", i believe they shouldn't be exposed in the logs. I have provided below an excerpt of the log message and replaced my credentials with actualcredentialshere

1702650458045,"{""level"":""debug"",""ts"":""2023-12-15T14:27:38.045Z"",""caller"":""vcs/gh_app_creds_rotator.go:58"",""msg"":""Refreshing git tokens for Github App"",""json"":{}}"
1702650458045,"{""level"":""debug"",""ts"":""2023-12-15T14:27:38.045Z"",""caller"":""vcs/gh_app_creds_rotator.go:64"",""msg"":""token actualcredentialshere"",""json"":{}}"
1702650458052,"{""level"":""debug"",""ts"":""2023-12-15T14:27:38.052Z"",""caller"":""vcs/git_cred_writer.go:36"",""msg"":""git credentials file has expected contents, not modifying"",""json"":{}}"

Describe the solution you'd like
Git credentials are masked or ommited

Describe the drawbacks of your solution
N/A

Describe alternatives you've considered
N/A

@nnovaeshc nnovaeshc added the feature New functionality/enhancement label Dec 15, 2023
@bschaatsbergen
Copy link
Contributor

I'll happily pick this up. Thanks for taking the time to raise this issue @nnovaeshc 馃憦

@nnovaeshc
Copy link
Author

@bschaatsbergen any updates on this?

@dobby-dobster dobby-dobster linked a pull request Jun 15, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature New functionality/enhancement security
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants