Skip to content

Commit 815e978

Browse files
committed
fix(relay-server): mask secret values in the invalid-value list
The Keys section runs every value through displayValue, which prints <set> for a name that looks like a credential. The Invalid values section printed the raw text instead. Nothing leaks today: an issue is only recorded when a boolean or integer fails to parse, and no credential is either. But the two lists are read the same way, and a report that masks a secret in one place and prints it in another is one numeric credential away from pasting it into a bug thread.
1 parent 1ecc3b0 commit 815e978

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

cmd/relay-server/config.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -483,7 +483,7 @@ func writeConfigReport(w io.Writer, cfg relayServerConfig, entries []envFileEntr
483483
if issues := utils.EnvIssues(); len(issues) > 0 {
484484
fmt.Fprintln(w, "\nInvalid values")
485485
for _, issue := range issues {
486-
fmt.Fprintf(w, " %s=%s %s\n", issue.Name, issue.Value, issue.Problem)
486+
fmt.Fprintf(w, " %s=%s %s\n", issue.Name, displayValue(issue.Name, issue.Value), issue.Problem)
487487
}
488488
}
489489
}

0 commit comments

Comments
 (0)