Prevent copy/paste of password and warn

[Rick-Anderson]

This falls under the company wide SFI (Secure Future Initiative)
Warn about password risk. Make it more difficult to copy/paste a password in config files and command lines.

@marcpopMSFT @sayedihashimi please recommend a reviewer

Contributes to dotnet/AspNetCore.Docs#33861

[sayedihashimi]

I'm not sure who is best to review, but I agree we should see if we can improve this from an SFI perspective. @bradygaster is deeply involved in that so he may know a good reviewer.

Also adding @vijayrkn.

[KalleOlaviNiemitalo]

This uses all of <Deploy-/p:Password>, </$Credential>, and </$;Credential;> in the same file. Is there some difference in semantics? All of these syntaxes look contorted.

[baronfel]

I'd strongly consider changing the doc to some mechanism that does not ingest secrets of any kind into MSBuild via Properties - once something is an MSBuild property it is visible to all Task and MSBuild logic that runs in that same build, so unless you are strictly auditing the build logic you use (including build logic from NuGet packages, etc) you're exposing yourself.

[baronfel]

Yes, good spot @KalleOlaviNiemitalo. Edited for clarity.

[KalleOlaviNiemitalo]

Could MSBuild detect Common annotated security keys and exclude them from logs?

[KalleOlaviNiemitalo]

Other mitigations for production environments:

• Use MSBuild to create artifacts, but deploy them as a separate non-MSBuild step that has fewer dependencies and is easier to audit.
• Short-lived deployment keys. Needs support at the server, and a separate root of trust whose secrets are not exposed to the project.

[Rick-Anderson]

This uses all of <Deploy-/p:Password>, </$Credential>, and </$;Credential;> in the same file. Is there some difference in semantics? All of these syntaxes look contorted.

<Deploy-/p:Password> is used on the command line and /p is the command switch so should throw an error if copy/pasted.
</$Credential> is for the app pw, </$;Credential;> is for the connection string. I didn't want to use the same stub for both pw's, I don't want to encourage using the same pw for deployment and the connection string. I can combine those if you like.

EDIT

Changed </$;Credential;> to </$DB_Credential>

To make it harder to global copy/paste and use the same PW for two different services.

[Rick-Anderson]

@KalleOlaviNiemitalo please review and use the suggestion feature to submit an improvement.