Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Sanitize the history and exposed configuration #4964

Closed
corneil opened this issue Jun 28, 2022 · 1 comment
Closed

Sanitize the history and exposed configuration #4964

corneil opened this issue Jun 28, 2022 · 1 comment
Assignees
@corneil
Labels
status/in-progress Something is happening
Milestone
2.9.5

Comments

@corneil
Copy link
Contributor

corneil commented Jun 28, 2022

Hi guys,
Today I've seen another service who's exposing credentials or secrets.
From the dashboard on the stream deployment page, when a stream is deployed the dashboard retrieve stream history and manifests... informations are not hidden from services responses and displayed as is.
Get Deployment History i think, I'll check, https://docs.spring.io/spring-cloud-dataflow/docs/current/reference/htmlsingle/#api-guide-resources-stream-deployment-history
So i think that is more secure to create a http filter or a HandlerInterceptor to intercept all responses and sanitize them apart from the audit ?

Originally posted by @Hassen-BENNOUR in #4947 (comment)
@github-actions github-actions bot added the status/need-triage Team needs to triage and take a first look label Jun 28, 2022
@onobc onobc added this to the 2.9.5 milestone Jun 28, 2022
@corneil corneil self-assigned this Jun 28, 2022
@corneil corneil added status/in-progress Something is happening and removed status/need-triage Team needs to triage and take a first look labels Jun 29, 2022
@corneil corneil mentioned this issue Jun 29, 2022
Merged
corneil added a commit that referenced this issue Jun 30, 2022
@corneil
Add sanitizer to history output. (#4968)
439f26a 
Fixes - #4964
This was referenced Jul 1, 2022
Closed
Merged
onobc pushed a commit that referenced this issue Jul 1, 2022
@corneil
Sanitize stream history data (backport #4964)
e9b08b4
@corneil
Copy link
Contributor Author

corneil commented Jul 6, 2022

Merged on Main and 2.9.x

@corneil corneil closed this as completed Jul 6, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@corneil corneil

Labels
status/in-progress Something is happening
Projects
None yet
Milestone
2.9.5
Development

No branches or pull requests
2 participants
@corneil @onobc