Skip to content
This repository has been archived by the owner on Aug 28, 2023. It is now read-only.

Filter out any password from the manifest #11

Conversation

agrare
Copy link
Member

@agrare agrare commented Aug 13, 2019

Mitigate issues where someone could upload a manifest with the intention
of collecting passwords from the database by stripping out any of the
"password" fields defined in Vmdb::SettingsWalker

Depends on ManageIQ/manageiq#19103

@Fryguy
Copy link
Member

Fryguy commented Aug 13, 2019

cc @d-m-u @mturley

@Fryguy Fryguy added enhancement New feature or request ivanchuk/yes labels Aug 13, 2019
Copy link
Collaborator

@mturley mturley left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, good catch @agrare

@abellotti
Copy link
Contributor

maybe add a small spec to show that password fields are filtered.

@agrare
Copy link
Member Author

agrare commented Aug 13, 2019

@abellotti specs don't seem to be passing in this repo

@mturley
Copy link
Collaborator

mturley commented Aug 13, 2019

@agrare @abellotti yeah, I disabled the Ruby checks in Travis because I never got them to work when I started this plugin.. I was going to ask for some help figuring that out: #2

@agrare agrare force-pushed the filter_out_password_fields_from_manifest branch 2 times, most recently from bef4fbd to 61c151f Compare August 14, 2019 13:43
spec/manageiq Outdated
@@ -0,0 +1 @@
/home/agrare/src/manageiq/manageiq
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

probably shouldn't be here.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ugh yeah, the .gitignore for this repo is all wrong

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed

Mitigate issues where someone could upload a manifest with the intention
of collecting passwords from the database by stripping out any of the
"password" fields defined in Vmdb::SettingsWalker
@agrare agrare force-pushed the filter_out_password_fields_from_manifest branch from 61c151f to 0331fa1 Compare August 14, 2019 13:49
@agrare
Copy link
Member Author

agrare commented Aug 14, 2019

Okay @abellotti if you change vmdb_plugin? to true this passes rspec locally

@miq-bot
Copy link

miq-bot commented Aug 14, 2019

Checked commits agrare/cfme-migration_analytics@0331fa1~...b8d59cd with ruby 2.4.6, rubocop 0.69.0, haml-lint 0.20.0, and yamllint 1.10.0
2 files checked, 1 offense detected

**

  • 💣 💥 🔥 🚒 - Linter/Rubocop - missing config files

@mturley mturley merged commit 976dd3b into RedHatCloudForms:master Aug 14, 2019
@agrare agrare deleted the filter_out_password_fields_from_manifest branch August 14, 2019 15:46
simaishi pushed a commit that referenced this pull request Aug 15, 2019
…nifest

Filter out any password from the manifest

(cherry picked from commit 976dd3b)
@simaishi
Copy link

Ivanchuk backport details:

$ git log -1
commit 9610e34887f641df3ddf718c4e608bff5489a1b3
Author: Mike Turley <mike.turley@alum.cs.umass.edu>
Date:   Wed Aug 14 11:46:05 2019 -0400

    Merge pull request #11 from agrare/filter_out_password_fields_from_manifest
    
    Filter out any password from the manifest
    
    (cherry picked from commit 976dd3b1bed50cae792f0593b9398b88e56910b6)

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants