Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change: improve handling of sensitive data #1461

Merged
merged 1 commit into from
Aug 15, 2023
Merged

Change: improve handling of sensitive data #1461

merged 1 commit into from
Aug 15, 2023

Conversation

jjnicola
Copy link
Member

What:
Change: improve handling of sensitive data
Jira: SC-877

Why:
With this patch, sentitive data, like credential, are hidden when GET scan_id, and delete from the scan config once the scan was started.

How:
Run a scan with, the scan must contain credentials, of course:
curl --verbose --insecure --cert $CLIENT_CERT --cert-type PEM --key $CLIENT_KEY --request POST https://127.0.0.1:3000/scans -H "X-API-KEY: changeme" -d '@/tmp/simple_scan.json' | jq

And get the scan before and after staring it. Credentials shouldn't be shown after the path is applied.
curl --verbose --insecure --cert $CLIENT_CERT --cert-type PEM --key $CLIENT_KEY --request GET https://127.0.0.1:3000/scans/<THE SCAN ID> -H "X-API-KEY: changeme" | jq .

Checklist:

  • Tests
  • PR merge commit message adjusted

@jjnicola jjnicola requested a review from a team as a code owner July 26, 2023 13:45
@jjnicola jjnicola enabled auto-merge (squash) July 26, 2023 13:45
Copy link
Member

@Kraemii Kraemii left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had an alternative idea, by implementing this directly into serde. This can be done, by adding a line like:

#[serde(serialize_with = "crate::censor")]

To the object, that should be hidden and a function like:

fn censor<S, T>(_: &T,serializer: S) -> std::result::Result<S::Ok, S::Error> where S: Serializer {
  serializer.serialize_str("***")
}

In this case we would be able to censor any data, by just adding the serde flag to it

    Jira: SC-877

    With this patch, sentitive data, like credential, are hidden when GET scan_id
@jjnicola jjnicola merged commit b6802eb into main Aug 15, 2023
27 checks passed
@jjnicola jjnicola deleted the rm-credential branch August 15, 2023 11:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants