Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

teststructure.SaveEc2KeyPair exposes the private key in the log output #1135

Closed
RothAndrew opened this issue May 31, 2022 · 3 comments · Fixed by #1480
Closed

teststructure.SaveEc2KeyPair exposes the private key in the log output #1135

RothAndrew opened this issue May 31, 2022 · 3 comments · Fixed by #1480
Labels
enhancement New feature or request

Comments

@RothAndrew
Copy link

teststructure.SaveEc2KeyPair exposes the private key in the log output when it logs the marshaled JSON data. This creates a security risk to my project since it is open source and has its pipeline logs exposed publicly. Even though the key pair and the instance that it is attached to only exist for a few minutes it is still a risk.

Suggested Fixes:

  • Implement a function such as logger.Use() that would let me switch to the logger.Discard logger while I run the function call, then switch back.
  • Update the function definition to let the user specify which logger to use
  • Just remove logger.Logf(t, "Marshalled JSON: %s", string(bytes)) from save_test_data.go::SaveTestData()

Visual aids (this is a key pair that has since been deleted)
Screen Shot 2022-05-31 at 12 21 46 PM

@RothAndrew
Copy link
Author

RothAndrew commented May 31, 2022

More possible suggestions:

  • Implement different log levels such as DEBUG, TRACE, ERROR, WARNING, etc, and only log that data if the log level is set to debug+
  • Modify the function definition to add a parameter discardLogs which switches to logger.Discard.Logf() if the value is true
  • Add a new function that adds discardLogs param and deprecate the old one for backward compatibility

@RothAndrew
Copy link
Author

Happy to submit a PR for this if any of these suggestions gains traction.

@denis256
Copy link
Member

denis256 commented Jun 2, 2022

Hi,
can be a good improvement for logs printing, any PRs are welcome

@denis256 denis256 added the enhancement New feature or request label Oct 3, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants