OIDC token mask uses the variable name instead of its value

Aperta
  • Qualcosa non va?
#86 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
1/5
Tempo stimato
Meno di un'ora
Idoneità per principianti
30/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github-actions
Ambito
security

Direzione di ricerca

The affected source is action.yml, lines 45–64. Read the token fetch and masking step, then inspect the proposed fix in linked issue #85. Done means the mask command registers the fetched token value and the existing GITHUB_OUTPUT value remains unchanged; the payload reports a local stubbed curl check.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Proposed fix: #85.

Problem

When using OIDC authentication (oauth-client-id and audience), the action registers the literal string ID_TOKEN for log masking instead of the fetched token's value:

echo "::add-mask::ID_TOKEN"

The missing $ matters: GitHub's add-mask command receives text to hide, not the name of a variable to look up. Authentication can still succeed while token redaction is incorrect.

Affected source: action.yml at 5a4a17f, lines 45–64.

Where the token could appear

The next step, Gitops pusher, passes the fetched token through the TS_ID_TOKEN environment variable. The GitHub Actions runner prints step environment names and values in the log header.

The relevant location is the workflow job log, inside the expanded Run go run tailscale.com/cmd/gitops-pusher… group, under env:. This output path does not require an extra debugging command or explicit token print in the action.

Unless another masking mechanism protects the value, the incorrect mask can hide the ID_TOKEN portion of the variable name while leaving the token value visible. A schematic example using a fictional value is:

env:
  TS_***: example-token-123

The impact depends on who can read the workflow logs, whether the token is still valid, and the permissions granted by the Tailscale federated identity. In particular, policy-write permissions make a usable leaked token more consequential.

Expected behavior and fix

Register the actual token value before passing it to the next step:

echo "::add-mask::$ID_TOKEN"

Subsequent occurrences of that value should then be redacted as ***. This one-line fix is proposed in #85.

Validation and limits

The actual fetch script was executed locally with a stubbed curl response and a synthetic token. The original code emitted ::add-mask::ID_TOKEN; the fix emitted the mask command containing the synthetic token value. The GITHUB_OUTPUT value was unchanged.

This confirms the incorrect masking command. The environment-log path above is based on action and runner source inspection, not an end-to-end reproduction on a hosted runner. No real token exposure or exploitation has been observed, and no real credentials were used in the local check.

Lingua principale
Nessun dato sulla lingua
Stelle
153
Fork
44
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di tailscale/gitops-acl-action

Tutte le issue di tailscale/gitops-acl-action

Issue simili

Altre issue su Security

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.