search

jakubriegel / kotlin-shell

Tool for performing shell-like programing in Kotlin
Apache License 2.0
143 stars 8 forks source link

Sensitive ENV info leaks on process 🚨 #19

Open brizzbuzz opened 3 years ago

brizzbuzz commented 3 years ago

Currently org.zeroturnaround.exec.ProcessExecutor calls are logged, which leads to dangerous scenarios where sensitive environment info can be leaked into logs.

Example

[[[SystemProcess 1] -1 git]_execution_thread] DEBUG o.z.exec.ProcessExecutor - Executing [git, clone, https://github.com/bkbnio/skelegro] in /Users/lappy/Workspace/bkbnio/cortex with environment {PATH=..., VERY_SECRET_KEY=123}