Skip to content

fix : [WTO-332] Sanitize sensitive information from URLs in terminal output #15053

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

rohanKanojia
Copy link

@rohanKanojia rohanKanojia commented May 14, 2025

Description

Related to https://issues.redhat.com/browse/WTO-332

When user is using Web Terminal in proxy environment, and prints environment variables, proxy credentials are visible:

$ printenv

https_proxy=http://username:password@hostname:3128/ # URL showing basic auth credentials 
http_proxy=http://username:password@hostname:3128/ # URL showing basic auth credentials

Sanitize sensitive information from URLs like proxy credentials before printing them to the web terminal console.

Before this change

behavior on OpenShift 4.18 cluster created via cluster bot
Screenshot_20250515_010248

After this change

Reloading console deployment with quay.io/rokumar/console:latest
wto-332-ui-fix-after-screenshot

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 14, 2025
Copy link
Contributor

openshift-ci bot commented May 14, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rohanKanojia
Once this PR has been reviewed and has the lgtm label, please assign karthikjeeyar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label May 14, 2025
Copy link
Contributor

openshift-ci bot commented May 14, 2025

Hi @rohanKanojia. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@vikram-raj
Copy link
Member

/ok-to-test

@openshift-ci openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 15, 2025
Sanitize sensitive information from URLs like proxy crdentials before printing them
to web terminal console.

Signed-off-by: Rohan Kumar <[email protected]>
@rohanKanojia
Copy link
Author

/ok-to-test

@rohanKanojia rohanKanojia force-pushed the pr/issue-wto-332 branch 3 times, most recently from 8597012 to f2393b6 Compare May 15, 2025 20:37
Instead of replacing all URLs, just replace Proxy URLs in command output.
First extract the URL values from Pod spec then perform search/replace

Signed-off-by: Rohan Kumar <[email protected]>
@rohanKanojia
Copy link
Author

/ok-to-test

Copy link
Contributor

openshift-ci bot commented May 16, 2025

@rohanKanojia: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/frontend a558ea3 link true /test frontend
ci/prow/okd-scos-e2e-aws-ovn a558ea3 link false /test okd-scos-e2e-aws-ovn

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. ok-to-test Indicates a non-member PR verified by an org member that is safe to test.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants