search

oracle-quickstart / oci-arch-devops

Universal Permissive License v1.0
12 stars 23 forks source link

Password exposed in Terraform logs #10

Closed jonschreiber closed 3 years ago

jonschreiber commented 3 years ago

Seen by a customer ... for a Functions deployment, the docker auth pwd is exposed in the logs

I was trying to build pipe line using https://docs.oracle.com/en/solutions/build-pipeline-using-devops/index.html#GUID-71D3B9D8-B72B-47A3-9943-885E58316A22 and notice that my account password was shown in clear text part of the logs shown on the console null_resource.Login2OCIR(local-exec): Executing: [“/bin/sh” “-c” “echo ‘CLEARTEXTHERE’ | docker login phx.ocir.io --username seomcsjcs2/@oracle.com --password-stdin”]**** Is this expected ? (edited)

lfeldman commented 3 years ago

I have introduced a new release with updated code. Closing the issue.