Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Secret-bearing flag defaults (--credential, --repo, --askpass-url) are printed in cleartext in usage output

Aperta Adatta ai principianti
  • Qualcosa non va?
#1,001 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
78/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
go
Ambito
cli, security

Direzione di ricerca

Inizia in main.go, intorno alla registrazione dei flag alle righe 270-299 e ai percorsi di utilizzo alle righe 402 e 421; verifica come pflag usa il DefValue di ogni flag. Riproduci il problema con le variabili d’ambiente credential, repo e askpass-url, quindi verifica che l’output della guida e degli errori di parsing non contenga più i relativi valori segreti, mentre i normali valori analizzati e il logging di avvio esistente con i valori redatti rimangano invariati.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

What happened

--credential, --repo and --askpass-url take their default value from an environment
variable that can carry a secret. pflag prints a flag's default in usage output, so those
values appear in cleartext in --help and in the usage block printed on a flag parse error.

On master (main.go:276):

$ GITSYNC_CREDENTIAL='[{"url":"https://github.com","username":"bot","password":"SENTINEL_PAT"}]' \
    git-sync --nonexistent-flag
...
      --credential credentialSlice   one or more credentials (see --man for details)
                                     available for authentication
                                     (default [{"url":"https://github.com","username":"bot",
                                                "password":"SENTINEL_PAT"}])

Same shape for --repo with an embedded PAT:

$ GITSYNC_REPO='https://user:[email protected]/o/r.git' git-sync --help
      --repo string   the git repository to sync (required)
                      (default "https://user:[email protected]/o/r.git")

--man and --version are unaffected. Usage goes to stderr (main.go:402), except the
explicit --help path which uses stdout (main.go:421). Since git-sync usually runs as a
sidecar, both end up in the pod log, so a mistyped or stale flag in a manifest puts the
value into the log stream.

Why I think it is worth a small fix

The startup log line is already clean. logSafeFlags (main.go:1217-1258) replaces
cred.Password with REDACTED, redacts --password, and runs --repo through
redactURL. I checked at -v=4 that the startup line emits no secret, and at default
verbosity the flag is skipped entirely because an env-supplied default never sets Changed.
So the usage path looks like the one remaining gap in a control that already exists.

Two bits of history suggest this was scope rather than intent:

  • 162e543 ("Add --credential flag to spec multiple user/pass", #803) added the
    envString-as-default registration and the cred.Password = redactedString branch in
    logSafeFlags in the same diff. Redaction was applied to the log line; usage output was
    not in view at that moment.
  • #886 ("Add the idea of env-flags") introduced envFlag, described at env.go:323-326 as
    "useful for things like passwords, which should not be on the CLI because it can be seen
    in ps". GITSYNC_PASSWORD (main.go:270) and GITSYNC_GITHUB_APP_PRIVATE_KEY
    (main.go:299) use envFlagString and do not leak. --credential stayed on
    envString-as-default.

Related and previously fixed for the log path only: #602 and #851.

Possible fix

pflag prints Flag.DefValue, a string captured at registration, rather than re-serialising
the value, so masking it after registration leaves the parsed value untouched:

for _, name := range []string{"credential", "repo", "askpass-url"} {
    if f := pflag.CommandLine.Lookup(name); f != nil && f.DefValue != "" {
        f.DefValue = "<set from environment>"
    }
}

Alternatives: move --credential to the existing envFlag mechanism to match --password
(though that changes whether it is settable on the CLI, which may not be wanted), or apply
the logSafeFlags redaction inside a custom usage function so both output paths share one
implementation.

Upstream does not offer a knob here: spf13/pflag#204 (HideDefaultValue) is unmerged and
go.mod pins pflag v1.0.5.

Happy to send a PR in whichever shape you prefer.

On reporting channel

I am filing this in the open rather than through the Kubernetes security process because it
needs an operator mistake to trigger, not an attacker action, and because the security team
previously declined git-sync findings in this configuration-surface class as not crossing
the bar. If you would rather it went through the security process instead, say so and I will
move it.

Version

master as of 2026-08-28, main.go:276 unchanged. Reproduced from a fresh clone with a
locally built binary.

Lingua principale
Shell
Stelle
2.7k
Fork
470
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di kubernetes/git-sync

Tutte le issue di kubernetes/git-sync

Issue simili

Altre issue su Shell/Bash

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.