Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mask base64 values of secrets in pipeline logs #5030

Merged
merged 3 commits into from
Nov 18, 2024
Merged

Mask base64 values of secrets in pipeline logs #5030

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b31ab66
Mask base64 values of secrets in pipeline logs
MantavyaDh Nov 4, 2024
4609fdc
Merge branch 'master' into user/mdhingra/base64_masking
DergachevE Nov 14, 2024
7110c41
Merge branch 'master' into user/mdhingra/base64_masking
MantavyaDh Nov 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions src/Agent.Worker/Worker.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,20 @@ private void InitializeSecretMasker(Pipelines.AgentJobRequestMessage message)
var escapedSecret2 = variable.Value.Value.Replace("\r", "%0D")
.Replace("\n", "%0A");
AddUserSuppliedSecret(escapedSecret2);
// We need to mask the base 64 value of the secret as well
var base64Secret = Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(variable.Value.Value));
// Add the base64 secret to the secret masker
AddUserSuppliedSecret(base64Secret);
// also, we escape some characters for variables when we print them out in debug mode. We need to
// add the escaped version of these secrets as well
var escapedSecret3 = base64Secret.Replace("%", "%AZP25")
.Replace("\r", "%0D")
.Replace("\n", "%0A");
AddUserSuppliedSecret(escapedSecret3);
// Since % escaping may be turned off, also mask a version escaped with just newlines
var escapedSecret4 = base64Secret.Replace("\r", "%0D")
.Replace("\n", "%0A");
AddUserSuppliedSecret(escapedSecret4);
}
}

Expand Down
Loading