Skip to content

Gitlab Pipeline Trigger Token was shown in Pact Broker in Plaintext #993

Description

@jl3000x

Hi pact_broker team,

I faced some problem when I tried to use the webhook to trigger the pipeline of Gitlab.

Due to the internal restriction, rather than Project access token, I was only abled to use Pipeline trigger token, which is only allowed to be added into the request body like "token": {Pipeline-trigger-token}, not the promising request header.
Fortunately(or of course), it do trigger the pipeline at the currect timing as we wished.
While the problem is that the token added into the reqeust body wasn't masked as the one in added into the request header and the token has been shown in plaintext in the webhook setting or the webhook logs of Pact Broker, which may induce security concern.

It would be much appreciated of you to consider adding the masking for the token added in the request body as you did for those token in the header.
(And I guess the plain-text-token in the log may also disappeared.)

Looking forward to hearing from you soon.

Yours faithfully,

Shingou

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions