Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Passwords in command line options are logged in clear text #953

Closed
DarwinJS opened this issue Sep 8, 2016 · 1 comment
Closed

Passwords in command line options are logged in clear text #953

DarwinJS opened this issue Sep 8, 2016 · 1 comment

Comments

@DarwinJS
Copy link
Contributor

DarwinJS commented Sep 8, 2016

Original Title: "source add -s [url]-u [user] -p [pass]" puts clear text password in chocolatey log file

It appears that the default chocolatey logging (debug?) captures the password for a source in the log.

I have worked hard to eliminate the password being recorded on the clients I build using packer and chocolatey, but I can't fix this one.

Even for debug logs I think that secrets should not be recordable in the log.

@ferventcoder
Copy link
Member

ferventcoder commented Sep 9, 2016

We are addressing things similar to this in 0.10.1 - #948

@ferventcoder ferventcoder changed the title "source add -s [url]-u [user] -p [pass]" puts clear text password in chocolatey log file Passwords in command line options are logged in clear text Sep 18, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants