Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 21 additions & 1 deletion client/ios/NetBirdSDK/client.go
Original file line number Diff line number Diff line change
@@ -1,9 +1,12 @@
//go:build ios

package NetBirdSDK

import (
"context"
"fmt"
"net/netip"
"os"
"sort"
"strings"
"sync"
Expand Down Expand Up @@ -90,7 +93,8 @@ func NewClient(cfgFile, stateFile, deviceName string, osVersion string, osName s
}

// Run start the internal client. It is a blocker function
func (c *Client) Run(fd int32, interfaceName string) error {
func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
exportEnvList(envList)
log.Infof("Starting NetBird client")
log.Debugf("Tunnel uses interface: %s", interfaceName)
cfg, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
Expand Down Expand Up @@ -433,3 +437,19 @@ func toNetIDs(routes []string) []route.NetID {
}
return netIDs
}

func exportEnvList(list *EnvList) {
if list == nil {
return
}
for k, v := range list.AllItems() {
log.Debugf("Env variable %s's value is currently: %s", k, os.Getenv(k))
log.Debugf("Setting env variable %s: %s", k, v)

if err := os.Setenv(k, v); err != nil {
log.Errorf("could not set env variable %s: %v", k, err)
} else {
log.Debugf("Env variable %s was set successfully", k)
}
}
}
Comment on lines +441 to +455
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Avoid logging environment variable values to prevent credential leakage.

Lines 446-447 log both the current and new values of environment variables. Environment variables in this context (e.g., NB_FORCE_RELAY) may contain sensitive information such as authentication tokens, API keys, or relay credentials. Debug logs can be captured by logging frameworks, persisted to disk, or forwarded to external systems, creating a security risk.

Apply this diff to log only the key names without exposing values:

 func exportEnvList(list *EnvList) {
 	if list == nil {
 		return
 	}
 	for k, v := range list.AllItems() {
-		log.Debugf("Env variable %s's value is currently: %s", k, os.Getenv(k))
-		log.Debugf("Setting env variable %s: %s", k, v)
+		log.Debugf("Setting env variable: %s", k)
 
 		if err := os.Setenv(k, v); err != nil {
 			log.Errorf("could not set env variable %s: %v", k, err)
 		} else {
 			log.Debugf("Env variable %s was set successfully", k)
 		}
 	}
 }
🤖 Prompt for AI Agents
In client/ios/NetBirdSDK/client.go around lines 441 to 455, the function
exportEnvList logs environment variable values (current and new), which can leak
credentials; change the logging to only mention the environment variable names
and whether the set succeeded or failed, removing any prints of os.Getenv(k) or
v; on error include the variable name and the error only, and on success log
that the variable was set without including its value.

34 changes: 34 additions & 0 deletions client/ios/NetBirdSDK/env_list.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
//go:build ios

package NetBirdSDK

import "github.com/netbirdio/netbird/client/internal/peer"

// EnvList is an exported struct to be bound by gomobile
type EnvList struct {
data map[string]string
}

// NewEnvList creates a new EnvList
func NewEnvList() *EnvList {
return &EnvList{data: make(map[string]string)}
}

// Put adds a key-value pair
func (el *EnvList) Put(key, value string) {
el.data[key] = value
}

// Get retrieves a value by key
func (el *EnvList) Get(key string) string {
return el.data[key]
}

func (el *EnvList) AllItems() map[string]string {
return el.data
}

// GetEnvKeyNBForceRelay Exports the environment variable for the iOS client
func GetEnvKeyNBForceRelay() string {
return peer.EnvKeyNBForceRelay
}
2 changes: 2 additions & 0 deletions client/ios/NetBirdSDK/gomobile.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build ios

package NetBirdSDK

import _ "golang.org/x/mobile/bind"
Expand Down
2 changes: 2 additions & 0 deletions client/ios/NetBirdSDK/logger.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build ios

package NetBirdSDK

import (
Expand Down
2 changes: 2 additions & 0 deletions client/ios/NetBirdSDK/login.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build ios

package NetBirdSDK

import (
Expand Down
2 changes: 2 additions & 0 deletions client/ios/NetBirdSDK/peer_notifier.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build ios

package NetBirdSDK

// PeerInfo describe information about the peers. It designed for the UI usage
Expand Down
2 changes: 2 additions & 0 deletions client/ios/NetBirdSDK/preferences.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build ios

package NetBirdSDK

import (
Expand Down
2 changes: 2 additions & 0 deletions client/ios/NetBirdSDK/preferences_test.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build ios

package NetBirdSDK

import (
Expand Down
2 changes: 2 additions & 0 deletions client/ios/NetBirdSDK/routes.go
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
//go:build ios

package NetBirdSDK

// RoutesSelectionInfoCollection made for Java layer to get non default types as collection
Expand Down
Loading