OIDC token mask uses the variable name instead of its value

未关闭
  • 哪里不对？
#86 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
1/5
预计耗时
1 小时以内
新手友好度
30/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
github-actions
领域
security

调研方向

The affected source is action.yml, lines 45–64. Read the token fetch and masking step, then inspect the proposed fix in linked issue #85. Done means the mask command registers the fetched token value and the existing GITHUB_OUTPUT value remains unchanged; the payload reports a local stubbed curl check.

由索引模型根据 Issue 内容生成。

描述

Proposed fix: #85.

Problem

When using OIDC authentication (oauth-client-id and audience), the action registers the literal string ID_TOKEN for log masking instead of the fetched token's value:

echo "::add-mask::ID_TOKEN"

The missing $ matters: GitHub's add-mask command receives text to hide, not the name of a variable to look up. Authentication can still succeed while token redaction is incorrect.

Affected source: action.yml at 5a4a17f, lines 45–64.

Where the token could appear

The next step, Gitops pusher, passes the fetched token through the TS_ID_TOKEN environment variable. The GitHub Actions runner prints step environment names and values in the log header.

The relevant location is the workflow job log, inside the expanded Run go run tailscale.com/cmd/gitops-pusher… group, under env:. This output path does not require an extra debugging command or explicit token print in the action.

Unless another masking mechanism protects the value, the incorrect mask can hide the ID_TOKEN portion of the variable name while leaving the token value visible. A schematic example using a fictional value is:

env:
  TS_***: example-token-123

The impact depends on who can read the workflow logs, whether the token is still valid, and the permissions granted by the Tailscale federated identity. In particular, policy-write permissions make a usable leaked token more consequential.

Expected behavior and fix

Register the actual token value before passing it to the next step:

echo "::add-mask::$ID_TOKEN"

Subsequent occurrences of that value should then be redacted as ***. This one-line fix is proposed in #85.

Validation and limits

The actual fetch script was executed locally with a stubbed curl response and a synthetic token. The original code emitted ::add-mask::ID_TOKEN; the fix emitted the mask command containing the synthetic token value. The GITHUB_OUTPUT value was unchanged.

This confirms the incorrect masking command. The environment-log path above is based on action and runner source inspection, not an end-to-end reproduction on a hosted runner. No real token exposure or exploitation has been observed, and no real credentials were used in the local check.

主要语言
没有语言数据
星标
153
派生
44
30 天内没有已合并 PR

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

tailscale/gitops-acl-action 的其他 Issue

查看 tailscale/gitops-acl-action 的全部 Issue

相似的 Issue

更多 Security Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。