[PR #223/af603262 backport][stable-1] [security] Add missing no_log=True, and mark false-positives with no_log=False #224
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![patchback[bot]](https://avatars.githubusercontent.com/in/21488?s=60&v=4){kind=small}
…log=False (#223) * Added no_log=False to clear false-positives. * Some more that seem to be false-positives with the examples from https://github.com/avinetworks/devops. * Guesswork. * These definitely miss no_log=True. * Add changelog fragment. (cherry picked from commit af60326)
dericcrago
deleted the
patchback/backports/stable-1/af60326281d0a193f57189dd44706e3aa9516797/pr-223
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a backport of PR #223 as merged into main (af60326).
SUMMARY
Most places found by the new sanity test are false-positives, but there are some real problems:
enckey_base64which might contain a secret. The documentation is also not really helpful; I think it's better to mark thisno_log=Trueas well.verification_tokenwhich might be harmless, but might also be a secret. It's not really clear from the documentation and I was not able to find any example.CC @dericcrago @gundalow @relrod
ISSUE TYPE
COMPONENT NAME
avi_cloudconnectoruser
avi_sslkeyandcertificate
avi_webhook
avi_pool
avi_serviceenginegroup
avi_virtualservice
cnos_user
netscaler_cs_vserver
netscaler_lb_vserver
netscaler_ssl_certkey