Mask rendered data (in logs) #48291
Merged
Mask rendered data (in logs) #48291
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 6 commits
June 25, 2018 15:12
terminalmage
suggested changes
Jun 25, 2018
salt/utils/sanitizers.py
Outdated
| for line in data.split(os.linesep): | ||
| if fnmatch.fnmatch(line.strip(), mask) and ':' in line: | ||
| key, value = line.split(':', 1) | ||
| out.append('{}: {}'.format(key.strip(), '** hidden **')) |
There was a problem hiding this comment.
Just as a precaution, key.strip() should probably be salt.utils.stringutils.to_unicode(key.strip()), to prevent a UnicodeDecodeError if key happens to be a str type with non-ascii unicode in it.
salt/utils/sanitizers.py
Outdated
|
|
||
| Note, this is working only when data is a single string, | ||
| ready for print or dump to the log. Also, when the data is formatted | ||
| as "key: value" in YAML syntax. |
There was a problem hiding this comment.
Can we reword the above two paragraphs like this?
This can be used for cases where keys in your roster file may contain
sensitive data such as IP addresses, passwords, user names, etc.
Note that this works only when ``data`` is a single string (i.e. when the
data in the roster is formatted as ``key: value`` pairs in YAML syntax).
|
@terminalmage done! |
terminalmage
approved these changes
Jun 25, 2018
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
What issues does this PR fix or reference?
When you call
salt-ssh -l debug, you will get the entire roster with the passwords directly in the log. This PR fixes this by matchingkey: valuestrings in the output data and replaces YAML values with the** hidden **string. This can be applied for passwords, user IDs, actual IP addresses etc.NOTE: this is so far is limited only to
key: valuewherevalueis replaced. Feel free to extend it for IP addresses etc.Tests written?
Yes