Blackbox exporter modules leaking sensitive data as it get logged as plaintext

[mvnarsing]

Blackbox exporter module can contain passwords as part of basic auth, its not treating modules as sensitive value and leaking info in plaintext

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet:
• Ruby:
• Distribution:
• Module version:

How to reproduce (e.g Puppet code you use)

ex_http_post_200:
    prober: http
    timeout: 10s
    http:
      valid_http_versions:
        - HTTP/1.1
        - HTTP/2.0
      follow_redirects: true
      preferred_ip_protocol: "ip4"
      method: POST
      headers:
        Content-Type: text/xml
      valid_status_codes: [200]
      body: {}
      basic_auth:
        username: "%{lookup('ex_username')}"
        password: "%{lookup('ex_password')}"

What are you seeing

password is displayed in plaintext as part of puppet runs

What behaviour did you expect instead

hash or sensitive password

Any additional information you'd like to impart

workaround we applied is to not show diff for puppet runs, submitting PR with code changes for this fix. PR

file { $config_file:
    ensure  => file,
    owner   => 'root',
    group   => $group,
    mode    => $config_mode,
    `show_diff => false,`
    content => template('prometheus/blackbox_exporter.yaml.erb'),
    notify  => $notify_service,
  }