[Bug][API] GET /projects exposes GitLab token in the gitextractor plugin

[richard-fletcher]

Search before asking

• [X] I had searched in the issues and found no similar issues.

What happened

When calling GET /blueprints/{blueprintId} access tokens are correctly masked for gitextractor GitLab connections. When calling GET /projects/{projectName} the token is not masked in the Blueprint response.

What do you expect to happen

The token to be masked in the response from GET /projects/{projectName}

How to reproduce

• Add a project with a GitLab connection
• Retrieve the project from the API

Anything else

No response

Version

v0.21.0

Are you willing to submit PR?

• [ ] Yes I am willing to submit a PR!

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

[dosubot[bot]]

Hey there, @richard-fletcher! 👋 I'm here to help you with bugs, questions, and becoming a contributor. I'm a bot, but I can assist while you wait for a human maintainer.

To ensure that the GitLab token is masked in the response from the GET /projects/{projectName} endpoint, you can use the Sanitize method defined in the GitlabConn and GitlabConnection structs. This method replaces the token with a sanitized version.

Here is the relevant code snippet that shows how the Sanitize method is used:

func (conn *GitlabConn) Sanitize() GitlabConn {
    conn.Token = utils.SanitizeString(conn.Token)
    return *conn
}

func (connection GitlabConnection) Sanitize() GitlabConnection {
    connection.GitlabConn = connection.GitlabConn.Sanitize()
    return connection
}

To ensure the token is masked in the response, you should call the Sanitize method on the GitlabConnection object before returning it in the response of the GET /projects/{projectName} endpoint. Here is an example of how you might do this:

func GetProjectHandler(w http.ResponseWriter, r *http.Request) {
    // Assume you have a function to get the GitlabConnection object
    connection := getGitlabConnectionFromRequest(r)

    // Sanitize the connection to mask the token
    sanitizedConnection := connection.Sanitize()

    // Return the sanitized connection in the response
    json.NewEncoder(w).Encode(sanitizedConnection)
}

This ensures that the token is masked in the response, protecting sensitive information ^[1].

To continue talking to Dosu, mention @dosu.