Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: issue with accidental secret exposure via wrong syntax #110

Merged
merged 3 commits into from
Sep 29, 2020

Conversation

tvangtarget
Copy link
Contributor

When using the method to inject a secret with alternative name, ie.

secrets:
  - source: secret
    target: alt_secret

it's possible to expose the secret by doing the following:

secrets:
  - source: secret
  - target: alt_secret

@tvangtarget tvangtarget requested a review from a team as a code owner September 28, 2020 19:52
@codecov
Copy link

codecov bot commented Sep 28, 2020

Codecov Report

Merging #110 into master will increase coverage by 0.00%.
The diff coverage is 100.00%.

Impacted file tree graph

@@           Coverage Diff           @@
##           master     #110   +/-   ##
=======================================
  Coverage   99.20%   99.20%           
=======================================
  Files          46       46           
  Lines        2757     2759    +2     
=======================================
+ Hits         2735     2737    +2     
  Misses         12       12           
  Partials       10       10           
Impacted Files Coverage Δ
yaml/secret.go 93.75% <100.00%> (+0.20%) ⬆️

wass3r
wass3r previously approved these changes Sep 28, 2020
yaml/secret.go Outdated Show resolved Hide resolved
Copy link
Contributor

@jbrockopp jbrockopp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@wass3r wass3r merged commit 574ca72 into go-vela:master Sep 29, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants