fix(security): credential redaction in 0f8b000 misses JSON bodies access_token, refresh_token, clientSecret, and password print verbatim with --verbose
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 88/100
Research direction
Start with redactSensitiveContent and the existing patterns, then run pkg/config/redact_probe_test.go using go test ./pkg/config/ -run TestRedactProbe -v. Check the call sites noted in keycloak_client.go:96 and microcks_client.go:371. Done means the six probe failures pass and access_token, refresh_token, clientSecret, and password no longer print verbatim in verbose output.
Written by the indexing model from the issue text.
Description
Problem
i added credential redaction to verbose HTTP dumps. It works for Authorization headers but misses both places where secrets actually appear.
Leak 1 Keycloak token response (keycloak_client.go:96)
The response body is JSON. The regex expects name=value (form encoding), so "access_token":"eyJ..." prints verbatim.
Leak 2 create-test request body (microcks_client.go:371)
OAuth2ClientContext is marshalled into the POST body. Fields clientSecret, password, and refreshToken aren't in the pattern at all.
The header redaction fires correctly, which is exactly what makes this easy to miss:
Authorization: [REDACTED] ← works
{"oAuth2Context":{"clientSecret":"SECRET","password":"SECRET",...}} ← leaks
Root Cause
// only matches name=value — never fires on JSON bodies
var sensitiveParamPattern = regexp.MustCompile(
`(?i)(access_token|refresh_token|id_token|code)=([^&\s]+)`,
)
Apply it alongside the existing patterns in redactSensitiveContent.
Reproduce
Drop into pkg/config/redact_probe_test.go and run go test ./pkg/config/ -run TestRedactProbe -v — 6 FAILs, all confirmed against the real function.
- Dominant language
- Go
- Stars
- 52
- Forks
- 67
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 13
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microcks/microcks-cli
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
microcks/microcks-cli#536 · 1 comment ·
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
microcks/microcks-cli#535 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
microcks/microcks-cli#534 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
microcks/microcks-cli#511 ·
-
stale
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
microcks/microcks-cli#483 · 3 comments ·
All issues in microcks/microcks-cli
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
-
enhancement needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
kind/cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
kubernetes-sigs/kueue#15947 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100