search

SteeltoeOSS / Samples

Steeltoe samples and reference application collection
https://steeltoe.io/
Apache License 2.0
641 stars 250 forks source link

CloudFoundry credentials visible in pipeline test log #247

Closed ccheetham closed 1 year ago

ccheetham commented 1 year ago

The test.log published by the Samples pipeline includes the CloudFoundry credentials in plaintext. E.g:

...
[2022-07-29 17:56:29,701] option: CloudFoundry username -> PLAIN_TEST_USER
[2022-07-29 17:56:29,701] option: CloudFoundry password -> *
...
command[1] cmd: cf login -a https://api.sys.longbeach.cf-app.com -u PLAIN_TEST_USER -p PLAIN_TEXT_PASSWORD ...
...

Credentials should be obscured. E.g.:

...
[2022-07-29 17:56:29,701] option: CloudFoundry username -> ***
[2022-07-29 17:56:29,701] option: CloudFoundry password -> ***
...
command[1] cmd: cf login -a https://api.sys.longbeach.cf-app.com -u *** -p *** ...
...