Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change sensitive configs type to Password. #35

Conversation

mashhurs
Copy link
Contributor

@mashhurs mashhurs commented Dec 5, 2022

Description

This PR ensures to protect the password, security_token and client_secret from leaks in the debug logs.

Test

# config
input {
      salesforce {
        client_id => "OAUTH_CLIENT_ID_FROM_YOUR_SFDC_APP"
        client_secret => "OAUTH_CLIENT_SECRET"
        username => "email@example.com"
        password => "super-secret"
        security_token => "SECURITY_TOKEN"
        sfdc_object_name => "Opportunity"
      }
}
output {
    stdout {}
}
# Log before change
# Log before change
[2022-12-01T18:05:17,380][DEBUG][logstash.inputs.salesforce] config LogStash::Inputs::Salesforce/@password = "super-secret"
[2022-12-01T18:05:17,380][DEBUG][logstash.inputs.salesforce] config LogStash::Inputs::Salesforce/@sfdc_object_name = "Opportunity"
[2022-12-01T18:05:17,380][DEBUG][logstash.inputs.salesforce] config LogStash::Inputs::Salesforce/@security_token = "SECURITY_TOKEN"
[2022-12-01T18:05:17,380][DEBUG][logstash.inputs.salesforce] config LogStash::Inputs::Salesforce/@client_secret = "OAUTH_CLIENT_SECRET"
[2022-12-01T18:05:17,380][DEBUG][logstash.inputs.salesforce] config LogStash::Inputs::Salesforce/@id = "bd7dc92c85796c3ea5c00db2b609c7de40dbe32a5b98bf14df4a66139f117090"
[2022-12-01T18:05:17,380][DEBUG][logstash.inputs.salesforce] config LogStash::Inputs::Salesforce/@client_id = "OAUTH_CLIENT_ID_FROM_YOUR_SFDC_APP"

# Log after change
[2022-12-01T18:01:36,390][DEBUG][logstash.inputs.salesforce] config LogStash::Inputs::Salesforce/@password = <password>
[2022-12-01T18:01:36,390][DEBUG][logstash.inputs.salesforce] config LogStash::Inputs::Salesforce/@sfdc_object_name = "Opportunity"
[2022-12-01T18:01:36,390][DEBUG][logstash.inputs.salesforce] config LogStash::Inputs::Salesforce/@security_token = <password>
[2022-12-01T18:01:36,390][DEBUG][logstash.inputs.salesforce] config LogStash::Inputs::Salesforce/@client_secret = <password>

	This change ensures to protect the sensitive config from leaks in debug logs.

	Fixes: logstash-plugins#34
	Pull-request: logstash-plugins#35
@mashhurs mashhurs added the bug label Dec 5, 2022
@mashhurs mashhurs self-assigned this Dec 5, 2022
Copy link

@roaksoax roaksoax left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm!

@mashhurs mashhurs merged commit 2949ebc into logstash-plugins:main May 27, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Change sensitive config types to Password.
2 participants