multiline secrets are not sanitized #57

New issue

Open

opened 2023-07-18 14:44:43 +00:00 by earl-warren · 1 comment

earl-warren commented

2023-07-18 14:44:43 +00:00

Owner

Steps to reproduce:

Create a secret with two lines (ONE TWO)

Run the workflow

on: [push]
jobs:
  test:
    runs-on: docker
    steps:
      - run: |
            set -x
            echo ">>>${{ secrets.MULTILINELEAK }}<<<"

See the secret displayed

Steps to reproduce: * Create a secret with two lines (ONE TWO) * Run the workflow ```yaml on: [push] jobs: test: runs-on: docker steps: - run: | set -x echo ">>>${{ secrets.MULTILINELEAK }}<<<" ``` * See the secret displayed ![image](/attachments/79f80266-8895-45a8-bab6-0bc837cb961b)

image.png

25 KiB

👍 1

earl-warren added the

Kind/Bug

Priority

Critical

labels 2023-07-18 14:44:43 +00:00

earl-warren commented

2023-07-22 06:58:19 +00:00

Author

Owner

In ACT

https://github.com/nektos/act/blob/master/pkg/runner/testdata/mask-values has some test data on how secrets are sanitized
https://github.com/nektos/act/blob/master/pkg/runner/logger.go#L146 the function doing the masking

In the runner

https://code.forgejo.org/forgejo/runner/src/branch/main/internal/pkg/report/reporter.go#L425-L428

There may be a regression / inconsistency there.

In ACT * https://github.com/nektos/act/blob/master/pkg/runner/testdata/mask-values has some test data on how secrets are sanitized * https://github.com/nektos/act/blob/master/pkg/runner/logger.go#L146 the function doing the masking In the runner * https://code.forgejo.org/forgejo/runner/src/branch/main/internal/pkg/report/reporter.go#L425-L428 There may be a regression / inconsistency there.