<< Back to previous view

[QB-1843] Secret variables can be referenced by clear-text variables, exposing the secret values
Created: 18/Nov/13  Updated: 04/Dec/13

Status: Resolved
Project: QuickBuild
Component/s: None
Affects Version/s: 5.0.31
Fix Version/s: 5.1.1

Type: Bug Priority: Minor
Reporter: David Stallard Assigned To: Unassigned
Resolution: Fixed Votes: 1
Remaining Estimate: Unknown Time Spent: Unknown
Original Estimate: Unknown


 Description   
When a clear-text variable references a secret variable, then anywhere that the clear-text variable gets referenced will show the secret value in clear text--for example, the Variables list for a build, the build log, etc. An example:

1) Define a secret variable, mySecretVar, and set it to "mysecret"
2) Define a clear text variable, myClearVar, and set it to "${vars.getValue("mySecretVar")}
3) After a build, myClearVar will show up in the Variables tab with its value in clear text, and possibly also in the build log depending on how it is used.

 Comments   
Comment by Robin Shen [ 19/Nov/13 02:36 PM ]
We tried to implement this but it is not as easy as we initially thought. Since the variable can be used anywhere in QB (due to QB's ability of scripting anywhere), and what we can do is to blindly mask out all occurence of password text in every possible QB recorded text (not only logging, but also configuration error messages, step error messages etc.), which is very tedious and error-prone...
Comment by productivity [ 25/Nov/13 06:35 PM ]
Saw this issue with repeat parameters: if you go to step status, you can see the value of the referenced secret variable.

Hope that it can be fixed since displaying plain-text passwords is a big issue.
Comment by Robin Shen [ 26/Nov/13 12:51 AM ]
Just curious why using secret variables in repeat params. This makes the issue really hard to fix as the repeat param value will be the key of step path.
Comment by productivity [ 04/Dec/13 10:51 PM ]
In this particular configuration, the secret variables were merely a part of the repeat parameter.

Essentially the configuration step is using repeat parameters in order to be able to build on a variable number of platforms. It just happened that the individual platform scripts being called required passwords in them. Note that this was inside a proof of concept configuration and we intend on improving this implementation in our production environment.

eg. build_platformA --password <password>, build_platformB --password <password>
Generated at Thu May 16 20:37:23 UTC 2024 using JIRA 189.