bitrise-steplib / steps-xcode-archive

Xcode Archive for iOS step
MIT License
65 stars 55 forks source link

Do not log sensitive command params when Apple ID authentication fails #333

Closed lpusok closed 9 months ago

lpusok commented 9 months ago

Checklist

Version

Requires a MAJOR/MINOR/PATCH version update

Context

Pulls in updated https://github.com/bitrise-io/go-xcode/pull/221.

We logged potential secrets due to using the v2/command package: https://github.com/bitrise-io/go-utils/blob/921272de13f5811b3a22dcd883459ea472c7f461/command/command.go#L172.

Apple ID authentication failed: The input stream is exhausted., error: command failed with exit status 1 (bundle "exec" "ruby" "main.rb" "--subcommand" "list_dev_certs" "--username" "myemail@gmail.com" "--password" "my-readable-password" "--session"

Fixed this by omitting the error returned by v2/command.

Resolves: https://github.com/bitrise-steplib/steps-xcode-archive/issues/328 https://bitrise.atlassian.net/browse/SSW-1144

Changes

Investigation details

Decisions