search

ef-labs / stash-hook-mirror

An Atlassian Stash repository hook for mirroring to one or more remote git repositories.
MIT License
77 stars 58 forks source link

Password / Token in plain text in debug mode. #87

Open johnhowlett opened 3 years ago

johnhowlett commented 3 years ago

Enable debug logging in Bitbucket-Server.

In the Log: 2021-07-09 14:57:36,868 DEBUG [MirrorRepositoryHook:thread-3] c.a.bitbucket.scm.BaseCommand Executed /usr/bin/git push --prune https://johnhowlett:<token_in_plain_text>@github.com/johnhowlett/bitbucket.git --force --atomic +refs/heads/*:refs/heads/* +refs/tags/*:refs/tags/* +refs/notes/*:refs/notes/* 2021-07-09 14:57:36,869 INFO [MirrorRepositoryHook:thread-3] c.a.s.i.c.HazelcastBucketedExecutor Attempt 1 of 5 at processing bucket 'MirrorRepositoryHook@5394:https://github.com/johnhowlett/bitbucket.git' for executor 'MirrorRepositoryHook' failed: 'An error occurred while executing an external process: process timed out' 2021-07-09 14:57:36,869 DEBUG [MirrorRepositoryHook:thread-3] c.a.s.i.c.HazelcastBucketedExecutor Exception: com.atlassian.bitbucket.ServerException: An error occurred while executing an external process: process timed out at com.atlassian.bitbucket.scm.git.command.GitCommandExitHandler.evaluateThrowable(GitCommandExitHandler.java:120) at com.atlassian.bitbucket.scm.git.command.GitCommandExitHandler.onError(GitCommandExitHandler.java:208) at com.atlassian.bitbucket.scm.DefaultCommandExitHandler.onExit(DefaultCommandExitHandler.java:32) at com.englishtown.bitbucket.hook.PasswordHandler.onExit(PasswordHandler.java:46) at com.atlassian.bitbucket.scm.BaseCommand.callExitHandler(BaseCommand.java:222) at com.atlassian.bitbucket.scm.BaseCommand$CommandFuture.internalGet(BaseCommand.java:351) at com.atlassian.bitbucket.scm.BaseCommand$CommandFuture.get(BaseCommand.java:323) at com.atlassian.bitbucket.scm.BaseCommand.call(BaseCommand.java:144) at com.englishtown.bitbucket.hook.MirrorBucketProcessor.runMirrorCommand(MirrorBucketProcessor.java:127) at com.englishtown.bitbucket.hook.MirrorBucketProcessor.lambda$process$0(MirrorBucketProcessor.java:77) at com.atlassian.stash.internal.user.DefaultEscalatedSecurityContext.call(DefaultEscalatedSecurityContext.java:59) at com.englishtown.bitbucket.hook.MirrorBucketProcessor.process(MirrorBucketProcessor.java:67) at com.atlassian.stash.internal.concurrent.HazelcastBucketedExecutor$BucketProcessingBootstrapper.run(HazelcastBucketedExecutor.java:146) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) at java.base/java.lang.Thread.run(Thread.java:829) ... 1 frame trimmed Caused by: com.atlassian.utils.process.ProcessTimeoutException: process timed out at com.atlassian.utils.process.ExternalProcessImpl.wrapUpProcess(ExternalProcessImpl.java:664) at com.atlassian.utils.process.ExternalProcessImpl.finish(ExternalProcessImpl.java:163) at com.atlassian.bitbucket.scm.BaseCommand$CommandFuture.get(BaseCommand.java:321) ... 12 common frames omitted

the psw/token is in plain text.

Expected: --prune https://johnhowlett:************@github.com/johnhowlett/bitbucket.git --force --atomic

In an environment where all logs are forwarded to Splunk, this is a security risk for us.

adrianluisgonzalez commented 3 years ago

This used to be masked in PasswordHandler.

Any interest in submitting a PR?