-
Notifications
You must be signed in to change notification settings - Fork 82
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Mask the value of the Authorization header if debug is enabled #501
Mask the value of the Authorization header if debug is enabled #501
Conversation
Signed-off-by: Ross Kirkpatrick <[email protected]> Signed-off-by: rosskirkpat <[email protected]>
Signed-off-by: Ross Kirkpatrick <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice catch thank you.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for your contribution! Everything looks great aside from @lgarber-akamai 's comment 👍
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll be out Thursday and Friday so I'll give this my preemptive approval for once my comment has been addressed. Thanks for the contribution!
Signed-off-by: Ross Kirkpatrick <[email protected]>
@lgarber-akamai When you have a minute, would I be able ant to get your sign-off on the latest commit? I believe this PR is ready to be merged now. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks perfect, thank you!
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [github.com/linode/linodego](https://github.com/linode/linodego) | `v1.33.1` -> `v1.34.0` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2flinode%2flinodego/v1.34.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/go/github.com%2flinode%2flinodego/v1.34.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/go/github.com%2flinode%2flinodego/v1.33.1/v1.34.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2flinode%2flinodego/v1.33.1/v1.34.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>linode/linodego (github.com/linode/linodego)</summary> ### [`v1.34.0`](https://github.com/linode/linodego/releases/tag/v1.34.0) [Compare Source](https://github.com/linode/linodego/compare/v1.33.1...v1.34.0) #### What's Changed #####⚠️ Breaking Change - \[BREAKING] Add support for LKE Control Plane ACL by [@​lgarber-akamai](https://github.com/lgarber-akamai) in [https://github.com/linode/linodego/pull/495](https://github.com/linode/linodego/pull/495) ##### 🐛 Bug Fixes - Prevent unexpected warning from Resty when calling `Client.SetDebug(false)` by [@​lgarber-akamai](https://github.com/lgarber-akamai) in [https://github.com/linode/linodego/pull/508](https://github.com/linode/linodego/pull/508) ##### 💡 Improvements - Mask the value of the Authorization header if debug is enabled by [@​rosskirkpat](https://github.com/rosskirkpat) in [https://github.com/linode/linodego/pull/501](https://github.com/linode/linodego/pull/501) - Expose region capabilities enum by [@​yec-akamai](https://github.com/yec-akamai) in [https://github.com/linode/linodego/pull/507](https://github.com/linode/linodego/pull/507) ##### ⚙️ Repo/CI Improvements - replace test execution handler with conditional by [@​ykim-1](https://github.com/ykim-1) in [https://github.com/linode/linodego/pull/502](https://github.com/linode/linodego/pull/502) ##### 📦 Dependency Updates - bump golang.org/x/net from 0.24.0 to 0.25.0 by [@​dependabot](https://github.com/dependabot) in [https://github.com/linode/linodego/pull/500](https://github.com/linode/linodego/pull/500) - bump github.com/go-resty/resty/v2 from 2.12.0 to 2.13.1 by [@​dependabot](https://github.com/dependabot) in [https://github.com/linode/linodego/pull/505](https://github.com/linode/linodego/pull/505) - bump golangci/golangci-lint-action from 5 to 6 by [@​dependabot](https://github.com/dependabot) in [https://github.com/linode/linodego/pull/506](https://github.com/linode/linodego/pull/506) #### New Contributors - [@​rosskirkpat](https://github.com/rosskirkpat) made their first contribution in [https://github.com/linode/linodego/pull/501](https://github.com/linode/linodego/pull/501) **Full Changelog**: linode/linodego@v1.33.1...v1.34.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/anza-labs/lke-operator). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zNjguMTAiLCJ1cGRhdGVkSW5WZXIiOiIzNy4zNjguMTAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImFyZWEvZGVwZW5kZW5jeSJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
📝 Description
What does this PR do and why is this change necessary?
If
LINODE_DEBUG
is enabled, the resty debug returns the plain-textAuthorization
header value from the request. This PR ensures that theAuthorization
header value will be sanitized/masked if debug mode is enabled.I also added a logger to the internal testutil package that is compliant with the resty.Logger interface.
✔️ How to Test
What are the steps to reproduce the issue or verify the changes?
Reproduce the issue: set
LINODE_DEBUG
when using linodego and observe a plain-text token in the debug output from resty ie.Authorization: Bearer <LINODE_TOKEN_PLAIN_TEXT>
Verify the changes: set
LINODE_DEBUG
when using linodego and observe a masked token in the debug output from resty (see below).How do I run the relevant unit/integration tests?
I added a new test
TestDebugLogSanitization
relating to these changes.