search

Snooz82 / robotframework-crypto

Library to securely handle credentials for Robot Framework.
Apache License 2.0
21 stars 13 forks source link

For loops leak secrets #30

Open Brownies opened 2 months ago

Brownies commented 2 months ago

The "Iteration" element leaks secrets if the iterable has a string representation of its contents. Minimal example:

*** Settings ***
Library         CryptoLibrary    password=password    variable_decryption=True    key_path=${CURDIR}

*** Variables ***
${secret}    crypt:BBsNlqXK9n/b8khTf02uJu0dehTe32DXUwbPMQqAYlMvu+2uCw3/RJKPjXDMcUhmyVfn2wh3Z97/frezmmstEOwg

*** Test Cases ***
Sample
    VAR    @{list}    ${secret}
    FOR    ${element}    IN    @{list}
        No Operation
    END

This results in log Private key for decrypting the "secret": private_key.json

Tested with robotframework 7.0.1 and robotframework-crypto 0.3.0