Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sos [report|collect] can leak upload user password to stdout #3465

Open
pmoravec opened this issue Jan 8, 2024 · 0 comments
Open

sos [report|collect] can leak upload user password to stdout #3465

pmoravec opened this issue Jan 8, 2024 · 0 comments

Comments

@pmoravec
Copy link
Contributor

pmoravec commented Jan 8, 2024

A side-issue from #3462 that we should also ideally fix: sos can print upload user credentials with password in plaintext to standard output - esp. when the upload fails. Then the engineer can easily provide (as a help to diagnose the upload failure) also their password, like:

# sos report --upload-url https://user:PASSWORD@URL --batch
..
Attempting upload to https://user:PASSWORD@URL
Upload attempt failed: ..

We should ideally obfuscate the PASSWORD there. Despite such password leak can happen only when engineer manually copies standard output, it is a weakness that can happen and we should prevent it.

This means get_upload_url_string method in LinuxPolicy needs to obfuscate a password if present, similarly like #3463 does, and RHELPolicy + UbuntuPolicy should call that method as a fallback (cf. https://github.com/sosreport/sos/blob/main/sos/policies/distros/redhat.py#L309 and https://github.com/sosreport/sos/blob/main/sos/policies/distros/ubuntu.py#L88).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant