SecretResourceApi.PutSecret serializes string body as JSON, storing secrets with extra quotes

Open Beginner friendly
#165 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
csharp
Domain
api

Research direction

Start in Conductor/Api/SecretResourceApi.cs at PutSecretWithHttpInfo and compare its request construction with the endpoint's text/plain contract. Check the related methods in EnvironmentResourceApi.cs for the same pattern, then verify that secret values are sent as raw text without extra quotes and that the request content type is text/plain.

Written by the indexing model from the issue text.

Description

bug

Summary

PutSecret / PutSecretWithHttpInfo stores secret values wrapped in extra JSON quotes (e.g. VERY SECRET is stored as "VERY SECRET"), making them unusable for authentication.

Root cause

Two defects compound in Conductor/Api/SecretResourceApi.cs (PutSecretWithHttpInfo):

1. Wrong Content-Type (line ~718)

String[] localVarHttpContentTypes = new String[] {
    "application/json"   // ← wrong
};

The server endpoint declares consumes = {MediaType.TEXT_PLAIN_VALUE, MediaType.ALL_VALUE}. It reads the body as raw bytes, not as JSON.

2. String body is JSON-serialized (line ~731-733)

if (body != null && body.GetType() != typeof(byte[]))
{
    localVarPostBody = this.Configuration.ApiClient.Serialize(body); // wraps string in JSON quotes
}

Because string is not byte[], this branch always runs for PutSecret, JSON-encoding the value and adding surrounding double-quotes before it hits the wire.

The same pattern exists in EnvironmentResourceApi — some methods there already declare text/plain but still call Serialize().

Fix

In PutSecretWithHttpInfo:

// Change content type
String[] localVarHttpContentTypes = new String[] {
    "text/plain"
};

// Skip serialization — string body passed as-is
localVarPostBody = body;

Workaround (until fixed)

Call the endpoint directly using HttpClient:

var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-Authorization", yourToken);
var content = new StringContent("VERY SECRET", Encoding.UTF8, "text/plain");
await client.PutAsync("https://your-server/api/secrets/MY_KEY", content);
Dominant language
C#
Stars
54
Forks
23
Avg merge
4d 21h
Merged PRs (30d)
2

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from conductor-oss/csharp-sdk

All issues in conductor-oss/csharp-sdk

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.