History | Log In     View a printable version of the current page.  
Issue Details (XML | Word | Printable)

Key: QB-1843
Type: Bug Bug
Status: Resolved Resolved
Resolution: Fixed
Priority: Minor Minor
Assignee: Unassigned
Reporter: David Stallard
Votes: 1
Watchers: 0
Operations

If you were logged in you would be able to see more operations.
QuickBuild

Secret variables can be referenced by clear-text variables, exposing the secret values

Created: 18/Nov/13 03:57 PM   Updated: 04/Dec/13 10:51 PM
Component/s: None
Affects Version/s: 5.0.31
Fix Version/s: 5.1.1

Original Estimate: Unknown Remaining Estimate: Unknown Time Spent: Unknown


 Description  « Hide
When a clear-text variable references a secret variable, then anywhere that the clear-text variable gets referenced will show the secret value in clear text--for example, the Variables list for a build, the build log, etc. An example:

1) Define a secret variable, mySecretVar, and set it to "mysecret"
2) Define a clear text variable, myClearVar, and set it to "${vars.getValue("mySecretVar")}
3) After a build, myClearVar will show up in the Variables tab with its value in clear text, and possibly also in the build log depending on how it is used.

 All   Comments   Work Log   Change History      Sort Order:
Robin Shen [19/Nov/13 02:36 PM]
We tried to implement this but it is not as easy as we initially thought. Since the variable can be used anywhere in QB (due to QB's ability of scripting anywhere), and what we can do is to blindly mask out all occurence of password text in every possible QB recorded text (not only logging, but also configuration error messages, step error messages etc.), which is very tedious and error-prone...

productivity [25/Nov/13 06:35 PM]
Saw this issue with repeat parameters: if you go to step status, you can see the value of the referenced secret variable.

Hope that it can be fixed since displaying plain-text passwords is a big issue.

Robin Shen [26/Nov/13 12:51 AM]
Just curious why using secret variables in repeat params. This makes the issue really hard to fix as the repeat param value will be the key of step path.

productivity [04/Dec/13 10:51 PM]
In this particular configuration, the secret variables were merely a part of the repeat parameter.

Essentially the configuration step is using repeat parameters in order to be able to build on a variable number of platforms. It just happened that the individual platform scripts being called required passwords in them. Note that this was inside a proof of concept configuration and we intend on improving this implementation in our production environment.

eg. build_platformA --password <password>, build_platformB --password <password>