microsoft / component-detection

Scans your project to determine what components you use
MIT License
396 stars 81 forks source link

Sanitize Docker environment vars in logs #1163

Closed grvillic closed 3 weeks ago

grvillic commented 3 weeks ago

Context

We spotted some ephemeral credentials in our telemetry due to syft being executed in a container and returning all/most of its environment variables.

Solution

Sanitize confidential information placed in URLs within env vars passed to Syft.

codecov[bot] commented 3 weeks ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 76.3%. Comparing base (e1b4ada) to head (c9a8c0c).

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #1163 +/- ## ===================================== Coverage 76.3% 76.3% ===================================== Files 256 256 Lines 11316 11329 +13 Branches 1135 1138 +3 ===================================== + Hits 8636 8649 +13 Misses 2348 2348 Partials 332 332 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

github-actions[bot] commented 3 weeks ago

👋 Hi! It looks like you modified some files in the Detectors folder. You may need to bump the detector versions if any of the following scenarios apply:

If none of the above scenarios apply, feel free to ignore this comment 🙂