OIDC token mask uses the variable name instead of its value

Abierto
  • ¿Algo no está bien?
#86 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
1/5
Tiempo estimado
Menos de una hora
Aptitud para principiantes
30/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions
Área
security

Línea de trabajo

The affected source is action.yml, lines 45–64. Read the token fetch and masking step, then inspect the proposed fix in linked issue #85. Done means the mask command registers the fetched token value and the existing GITHUB_OUTPUT value remains unchanged; the payload reports a local stubbed curl check.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Proposed fix: #85.

Problem

When using OIDC authentication (oauth-client-id and audience), the action registers the literal string ID_TOKEN for log masking instead of the fetched token's value:

echo "::add-mask::ID_TOKEN"

The missing $ matters: GitHub's add-mask command receives text to hide, not the name of a variable to look up. Authentication can still succeed while token redaction is incorrect.

Affected source: action.yml at 5a4a17f, lines 45–64.

Where the token could appear

The next step, Gitops pusher, passes the fetched token through the TS_ID_TOKEN environment variable. The GitHub Actions runner prints step environment names and values in the log header.

The relevant location is the workflow job log, inside the expanded Run go run tailscale.com/cmd/gitops-pusher… group, under env:. This output path does not require an extra debugging command or explicit token print in the action.

Unless another masking mechanism protects the value, the incorrect mask can hide the ID_TOKEN portion of the variable name while leaving the token value visible. A schematic example using a fictional value is:

env:
  TS_***: example-token-123

The impact depends on who can read the workflow logs, whether the token is still valid, and the permissions granted by the Tailscale federated identity. In particular, policy-write permissions make a usable leaked token more consequential.

Expected behavior and fix

Register the actual token value before passing it to the next step:

echo "::add-mask::$ID_TOKEN"

Subsequent occurrences of that value should then be redacted as ***. This one-line fix is proposed in #85.

Validation and limits

The actual fetch script was executed locally with a stubbed curl response and a synthetic token. The original code emitted ::add-mask::ID_TOKEN; the fix emitted the mask command containing the synthetic token value. The GITHUB_OUTPUT value was unchanged.

This confirms the incorrect masking command. The environment-log path above is based on action and runner source inspection, not an end-to-end reproduction on a hosted runner. No real token exposure or exploitation has been observed, and no real credentials were used in the local check.

Lenguaje dominante
Sin datos de lenguaje
Estrellas
153
Forks
44
Sin PR fusionados en 30 d

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de tailscale/gitops-acl-action

Todos los issues de tailscale/gitops-acl-action

Issues similares

Más issues de Security

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.