sync: Release candidate v0.40.0 #6740
Conversation
* notifier v1 removed * notifier v1 removed
…rviceImpl` to make token visibility configurable
sync: Main sync develop
chore: OSS main sync
fix: Build get Stuck Indefinitely in case of K8s Driver When Node Termination Occurs
chore: Api token hide via flag
# Conflicts: # env_gen.json
feat: enhance patch support for user attribute patch api within nested structure
chore: main sync
Co-authored-by: Pawan Mehta <[email protected]>
fix: send HideApiToken env var in api token create and update response
sync: Main sync develop
chore: post trigger
misc: notification table fix
vikramdevtron
requested review from
nishant-d,
prakarsh-dt and
vivek-devtron
as code owners
Code Review Agent Run #48c44bActionable Suggestions - 0Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
|
Changelist by BitoThis pull request implements the following key changes.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| workflowRequest, err = impl.updateWorkflowRequestWithBuildxFlags(workflowRequest, scope) | ||
| if err != nil { | ||
| impl.Logger.Errorw("error, updateWorkflowRequestWithBuildCacheData", "workflowRequest", workflowRequest, "err", err) | ||
| impl.Logger.Errorw("error, updateWorkflowRequestWithBuildxFlags", "workflowRequest", workflowRequest, "err", err) |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fix the problem, we need to ensure that sensitive information such as passwords, private keys, and access tokens are not logged. The most robust solution is to avoid logging the entire workflowRequest object, and instead log only non-sensitive fields, or to sanitize/redact sensitive fields before logging.
Best way to fix:
- Replace the log call on line 874 that logs the entire
workflowRequestobject with a call that logs only non-sensitive summary information—such asworkflowRequest.WorkflowNamePrefix,workflowRequest.PipelineId, or other relevant identifiers. - If deeper debugging information is needed, explicitly construct a sanitized version of the object for logging, omitting or replacing sensitive fields with redacted values.
- This change should be made in
pkg/build/trigger/HandlerService.goat the site of the vulnerable logging call.
No new imports are needed; we simply need to adjust the logger usage to avoid logging sensitive fields.
| @@ -871,7 +871,12 @@ | ||
| } | ||
| workflowRequest, err = impl.updateWorkflowRequestWithBuildxFlags(workflowRequest, scope) | ||
| if err != nil { | ||
| impl.Logger.Errorw("error, updateWorkflowRequestWithBuildxFlags", "workflowRequest", workflowRequest, "err", err) | ||
| impl.Logger.Errorw( | ||
| "error, updateWorkflowRequestWithBuildxFlags", | ||
| "workflowNamePrefix", workflowRequest.WorkflowNamePrefix, | ||
| "pipelineId", workflowRequest.PipelineId, | ||
| "err", err, | ||
| ) | ||
| return nil, nil, nil, err | ||
| } | ||
| if impl.canSetK8sDriverData(workflowRequest) { |
Description
Fixes #
Checklist:
Does this PR introduce a user-facing change?
Summary by Bito
This pull request prepares release candidate v0.40.0 with multiple enhancements focused on API token security, improved error handling, and event payload refinements. It includes extensive refactoring of key modules like UserAttributesService with robust JSON parsing and merging logic. The PR also updates dependencies, streamlines import paths, and incorporates standardized retry mechanisms across Git-related services.