Skip to content
This repository has been archived by the owner on Sep 30, 2024. It is now read-only.

If access to ORCHESTRATOR_API fails do not expose the password(s) #1319

Merged

Conversation

sjmudd
Copy link
Collaborator

@sjmudd sjmudd commented Mar 4, 2021

Description

Recently seen:

orchestrator-client[10450]: Cannot access orchestrator at http://user:password@host.com/api.  Check ORCHESTRATOR_API is configured correctly and orchestrator is running

This exposes the password.

Change to:

orchestrator-client[10450]: Cannot access orchestrator at http://user:<REMOVED>@host.com/api.  Check ORCHESTRATOR_API is configured correctly and orchestrator is running

Also works if ORCHESTRATOR_API contains multiple hostnames.

  • contributed code is using same conventions as original code

sjmudd and others added 2 commits March 4, 2021 10:06
Recently seen:

orchestrator-client[10450]: Cannot access orchestrator at http://user:password@host.com/api.  Check ORCHESTRATOR_API is configured correctly and orchestrator is running

This exposes the password.

Change to:

orchestrator-client[10450]: Cannot access orchestrator at http://user:<REMOVED>@host.com/api.  Check ORCHESTRATOR_API is configured correctly and orchestrator is running

Also works if ORCHESTRATOR_API contains mulitple hostnames.
Copy link
Collaborator

@shlomi-noach shlomi-noach left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you

@shlomi-noach shlomi-noach merged commit d36f90c into openark:master Mar 4, 2021
@sjmudd sjmudd deleted the sjmudd/orchestrator_client_santise_url branch March 4, 2021 13:01
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants