Skip to content

stop echoing credential contents in GetCredentials error #18575

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
naruto-lgtm wants to merge 1 commit into
base: main
Choose a base branch
from
+27 −2
Open

stop echoing credential contents in GetCredentials error #18575

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions mmv1/third_party/terraform/transport/config.go.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -626,7 +626,7 @@ func (c *Config) GetCredentials(clientScopes []string, initialCredentialsOnly bo
if c.UniverseDomain != "" && c.UniverseDomain != "googleapis.com" {
creds, err := transport.Creds(c.Context, option.WithCredentialsJSON([]byte(contents)), option.WithScopes(clientScopes...), internaloption.EnableJwtWithScope())
if err != nil {
return googleoauth.Credentials{}, fmt.Errorf("unable to parse credentials from '%s': %s", contents, err)
return googleoauth.Credentials{}, fmt.Errorf("unable to parse credentials: %s", err)
}
log.Printf("[INFO] Authenticating using configured Google JSON 'credentials'...")
log.Printf("[INFO] -- Scopes: %s", clientScopes)
Expand All @@ -635,7 +635,7 @@ func (c *Config) GetCredentials(clientScopes []string, initialCredentialsOnly bo
} else {
creds, err := transport.Creds(c.Context, option.WithCredentialsJSON([]byte(contents)), option.WithScopes(clientScopes...))
if err != nil {
return googleoauth.Credentials{}, fmt.Errorf("unable to parse credentials from '%s': %s", contents, err)
return googleoauth.Credentials{}, fmt.Errorf("unable to parse credentials: %s", err)
}
log.Printf("[INFO] Authenticating using configured Google JSON 'credentials'...")
log.Printf("[INFO] -- Scopes: %s", clientScopes)
Expand Down
25 changes: 25 additions & 0 deletions mmv1/third_party/terraform/transport/config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,10 @@ package transport_test

import (
"context"
"fmt"
"io/ioutil"
"os"
"strings"
"testing"
"time"

Expand Down Expand Up @@ -238,6 +240,29 @@ func TestConfigLoadAndValidate_accountFileJSONInvalid(t *testing.T) {
}
}

func TestGetCredentials_doesNotLeakCredentialsInError(t *testing.T) {
// A service-account key whose "type" is corrupted: still valid JSON, so it
// reaches the credential load and fails to parse there. The returned error
// surfaces to the terminal and CI logs, so it must not echo the key material.
const secret = "MIISECRETKEYMATERIAL_DO_NOT_LEAK"
creds := fmt.Sprintf(`{"type":"service_acount","project_id":"my-proj","private_key_id":"abc","private_key":"-----BEGIN PRIVATE KEY-----\n%s\n-----END PRIVATE KEY-----\n","client_email":"sa@my-proj.iam.gserviceaccount.com","token_uri":"https://oauth2.googleapis.com/token"}`, secret)

config := &transport_tpg.Config{
Context: context.Background(),
Credentials: creds,
Project: "my-gce-project",
Region: "us-central1",
}

_, err := config.GetCredentials([]string{testOauthScope}, false)
if err == nil {
t.Fatalf("expected an error loading invalid credentials, got nil")
}
if strings.Contains(err.Error(), secret) {
t.Fatalf("credentials leaked in error message: %s", err)
}
}

func TestAccConfigLoadValidate_credentials(t *testing.T) {
if os.Getenv(envvar.TestEnvVar) == "" {
t.Skipf("Network access not allowed; use %s=1 to enable", envvar.TestEnvVar)
Expand Down
Loading