jlewi / hydros

hydros automates hydrating and committing configuration
Apache License 2.0
4 stars 0 forks source link

Security - Log messages leak access token #29

Open jlewi opened 1 year ago

jlewi commented 1 year ago

Log commands from the shelling out to git messages can leak the access token e.g.

{"level":"error","ts":1684375173.299407,"caller":"util/exec.go:39","msg":"Shell command failed","ManifestSync.Name":"hydros-dev-takeover","run":"9ac0b","command":"/opt/homebrew/bin/git clone https://x-access-token:<TOKEN> ....

This might be fixed by updating syncer to use go-git rather than shelling out to git.