search

axemclion / grunt-saucelabs

Grunt task for running all your browser tests using Sauce Labs
MIT License
182 stars 98 forks source link

Credential leak in verbose mode #203

Closed Nycto closed 8 years ago

Nycto commented 8 years ago

This isn't really a problem with this module, but it is something I think could be handled here.

I was recently adding saucelabs to a project and flipped grunt in to verbose mode when running on Travis. Lo and behold, my username and authkey were printed to stdout. I probably should have expected this, but if I hadn't been picking through the logs, I never would have seen it.

To prevent this from happening to others, my suggestion is to implement one of the following:

  1. Don't store the authkey in the options hash, so it won't get printed
  2. Suppress printing of the authkey if it needs to be stored in the options hash
  3. If neither of those are possible, detect when 'verbose' is enabled and fail the build. Notify they user that they may need to cycle their credentials
Jonahss commented 8 years ago

:+1: good catch

emmettbutler commented 8 years ago

I'm providing a string for key in the options hash of my project's Gruntfile, and my build is erroring against code that includes this changeset #204. It looks like the documentation has also not been updated to indicate the proper way to specify the secret key. What's the correct way to provide key to the options hash?