Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Redact multiline secrets #238

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

rwberendsen
Copy link

Problem
When given a multi-line secret in the schemachange-config YAML, it would not be redacted, because just before calling SecretManager.global_redact, the config vars section would be serialised as YAML, adding leading whitespaces to the multiline secret

Proposed solution
Recurse over the config vars section, and redact all strings in it, and only then serialise as YAML. When redacting multiline secrets, preserve newlines.

Minor edits added in

  • The method that was extracting secrets would crash if the value was of a type that did not have the strip() method. Added an explicit raise of a ValueError if a secret is not of type str
  • Added tests for added functionality

Notes
For redacting in SQL queries nothing was changed, as indenting while rendering Jinja templates is under control of the user of schemachange.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant