Open mcgarebear opened 3 years ago
@mcgarebear You're saying that, when you give it a bad token, it echos it back and that's bad?
mmmm... the token is bad - by definition, this can't be a problem as a useless secret is being exposed. Pulling it from your own registry is your business. However, if you're a paying customer you can file a support ticket to see about getting some traction on the matter as this has nothing to do with terraform: this is the message coming straight from RT
I will be closing the ticket in the new repo. I can only suggest to the admins of this one to do the same
Community Note
Terraform Version
Terraform
v0.12.20
- but I suspect this will affect any Terraform version.Affected Resource(s)
github.com/atlassian/go-artifactory/v2/artifactory
client implementation when the provider invokes its configure function and attempts to ping ArtifactoryTerraform Configuration Files
Debug Output
Panic Output
Expected Behavior
If the provider encounters an authentication failure, I expect the provider to fail and cause a halt in Terraform execution. However, the API token should not be dumped back to console - the token should remain hidden and the provider only displays an indication of a bad token (possibly masking token details if it absolutely must be dumped?). Something like this:
Actual Behavior
The provider fails and dumps the token in plaintext to the console. This is a huge security issue causing us to pull/revoke this provider from our internal registry and redo compromised credentials.
Steps to Reproduce
Terraform Configuration Files
- give it a nonsensical token for your instanceImportant Factoids
This issue does not occur when using username/password auth. It appears to only occur on API key. It does not matter if this API key is specified via env vars or statically configured.
References
0000