fix(release): redact the token in the GitHub and GitLab release error output - #36852
Open
AgentEnder wants to merge 10 commits into
Open
fix(release): redact the token in the GitHub and GitLab release error output#36852AgentEnder wants to merge 10 commits into
AgentEnder wants to merge 10 commits into
Conversation
… output - The API-error output printed `Token Header Data: [object Object]`. It never leaked a token, but it read as a formatting bug and the obvious fix (`JSON.stringify`, as the adjacent `Body:` line does) would have written the bearer token to CI logs. - Print the header name with the value redacted instead, or `none` when no token was configured, so a failing release still shows which credential source was used. - Add specs for both clients asserting the token never appears in the output. Flagged by the Socket gptSecurity analysis of nx 23.1.2.
✅ Deploy Preview for nx-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for nx-dev ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
View your CI Pipeline Execution ↗ for commit 71cb8aa
☁️ Nx Cloud last updated this comment at |
… output [Self-Healing CI Rerun]
![nx-cloud[bot]](https://avatars.githubusercontent.com/in/80458?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
The fallback branch of handleError logged the raw error object, and an axios error carries the real token in `config.headers` and `request._header`. Dump it through util.inspect with the token value replaced by `<redacted>` instead.
… value
The dump is searched for the raw env value, but the rendered text can differ:
axios trims header values before sending, and inspect() escapes them. A token
with trailing whitespace therefore matched nothing and was printed in full,
while auth still succeeded, so the misconfiguration gave no signal.
Trim the token before searching and also redact its inspected rendering. The
trim doubles as the empty-token guard: the previous check tested tokenData,
not the token, so a blank value made split('') interleave the marker between
every character of the dump.
… value [Self-Healing CI Rerun]
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
The two needles coincide whenever the token has nothing for inspect() to escape, which is the normal case. The second pass then scans the whole dump again for no gain, and rewrites the marker the first pass inserted.
Node strips CR/LF from outgoing header values, so a token that picked one up (a wrapped paste into a CI variable) authenticates on the stripped form while the dump held it unredacted. Same shape as the trimming case: the sent value differs from the configured one.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Member
Author
|
Assigned. One thing to carry into review: this is a credential-redaction change, so what needs checking is whether every path that can surface the token is covered, not just the two error messages in the diff.
|
inspect() renders a long value carrying a line break as concatenated per-line chunks, so no whole-token needle spans it and a wrapped paste of a github_pat_ token (~93 chars) leaked. Redact each line as well, skipping fragments short enough to collide with ordinary dump text. Also covers the gaps the fix left untested: the JOB-TOKEN header, a blank token leaving the dump untouched, and the missing string-type guard on the trailing-whitespace specs.
…-Healing CI Rerun]
Contributor
There was a problem hiding this comment.
Nx Cloud has identified a flaky task in your failed CI:
🔂 Since the failure was identified as flaky, we triggered a CI rerun by adding an empty commit to this branch.
🔔 Heads up, your workspace has pending recommendations ↗ to auto-apply fixes for similar failures.
🎓 Learn more about Self-Healing CI on nx.dev
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Current Behavior
When creating a GitHub or GitLab release fails, the error output includes
Token Header Data: [object Object]. It doesn't leak the token today, but it reads like a formatting bug, and the obvious fix (JSON.stringify, like theBody:line next to it) would print the bearer token in CI logs.Expected Behavior
The line names the header the token was sent under, with the value redacted:
Token Header: Authorization: Bearer <redacted>, orToken Header: nonewhen no token was configured. Specs assert the token itself never appears.The unknown-error fallback right below had the same problem: it dumped the raw axios error, which carries the token in
config.headers. It now prints the error with the token value replaced by<redacted>.Related Issue(s)
Fixes #
NXC-4910, raised by https://socket.dev/npm/package/nx/alerts/23.1.2?alert_name=gptSecurity
View Polygraph session ↗