Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

SSO-OIDC client example tokens trip secret scanners (Trivy jwt-token, gitleaks) — redact JWT-shaped values in the service model

Abierto Apto para principiantes
  • ¿Algo no está bien?
#3,395 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
68/100
Tipo de issue
Documentación
Claridad
Bien especificado
Estado de actividad
Tranquilo
Stack tecnológico
aws, ruby
Área
cloud, documentation

Línea de trabajo

Comienza con el modelo de servicio canónico de SSO-OIDC, examples-1.json, e inspecciona los ejemplos de id_token, assertion y client_secret descritos en la issue. Verifica la salida generada de lib/aws-sdk-ssooidc/client.rb y ejecuta la reproducción de Trivy secret-scan; se considera terminado cuando los ejemplos siguen siendo placeholders útiles sin JWT-token findings.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

service-api
Describe the feature

The generated Aws::SSOOIDC::Client documentation embeds realistic-looking JWTs in its @example blocks for create_token and create_token_with_iam. Because these are full eyJ…-shaped tokens rather than obvious placeholders, secret scanners flag them as leaked credentials when they scan an application's installed gems / built container image.

Concretely, scanning an image that bundles aws-sdk-core (3.251.0) with Trivy's secret scanner produces a false positive on lib/aws-sdk-ssooidc/client.rb via the built-in jwt-token rule. The same false positive is reproducible with gitleaks and other regex-based scanners, and the same example values appear in aws-sdk-js-v3 and botocore, so this affects downstream consumers across all AWS SDKs.

These are clearly intentional example values (account 123456789012, ssoins-111111111111, the Microsoft [email protected] sample OIDC token, etc.), so this is a documentation-quality / false-positive-noise issue, not a leaked secret.

Affected examples

In aws-sdk-core 3.251.0, lib/aws-sdk-ssooidc/client.rb (generated from the SSO-OIDC examples-1.json model, API version 2019-06-10):

  • id_token in the example responses (the create_token_with_iam authorization-code, JWT-bearer, and token-exchange grant examples)
  • assertion in the JWT-bearer grant example request
  • client_secret in the create_token example requests (VERYLONGSECRETeyJ…)

Note the inconsistency: the neighboring access_token, refresh_token, and authorization code examples already end in explicit …EXAMPLEACCESSTOKEN / …EXAMPLEREFRESHTOKEN / …EXAMPLEAUTHCODE markers, but the JWT-shaped values do not, which is exactly why scanners single them out.

Proposed change

Redact the JWT-shaped example values in the canonical SSO-OIDC service model (examples-1.json) so they are unmistakably non-secret while still illustrating the field shape — for example a short, obviously-fake stub such as eyJhbGciOiJub25lIn0.eyJzdWIiOiJFWEFNUExFIn0.EXAMPLE or a <id-token>-style placeholder — matching the EXAMPLE… convention already used for the surrounding tokens. Because the SDK clients are generated from this shared model, fixing it upstream propagates to all SDKs.

Reproduction
trivy fs --scanners secret <path-to-bundled-gems>/aws-sdk-core-3.251.0
# or against an image that bundles the gem:
trivy image --scanners secret <image>
# -> JWT (jwt-token) finding on lib/aws-sdk-ssooidc/client.rb
Environment
  • aws-sdk-core 3.251.0
  • Trivy 15.0.7 (jwt-token secret rule); also reproducible with gitleaks
Lenguaje dominante
Ruby
Estrellas
3.7k
Forks
1.2k
Merge medio
1 d 16 h
PR fusionados (30 d)
25

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de aws/aws-sdk-ruby

Todos los issues de aws/aws-sdk-ruby

Issues similares

Más issues de Ruby

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.