Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Backport 7.x] (PUP-12050) Check for nested Sensitive arguments #9414

Merged
merged 2 commits into from
Jul 12, 2024
Merged

[Backport 7.x] (PUP-12050) Check for nested Sensitive arguments #9414

merged 2 commits into from
Jul 12, 2024

Commits on Jul 12, 2024

  1. (PUP-12050) Refactor compile_and_resolve_catalog 

    (cherry picked from commit bdf1a46)
    @joshcooper
    joshcooper committed Jul 12, 2024
    Configuration menu
    Copy the full SHA
    d1f1594 View commit details
    Browse the repository at this point in the history

  2. (PUP-12050) Check for nested Sensitive arguments 

    Previously, a manifest containing nested Deferred values did not mark
the corresponding parameter as sensitive, resulting in the following:

    $ cat manifest.pp
    $vars = {'token' => Deferred('new', [Sensitive, "password"])}
    file { '/tmp/a.sh':
      ensure  => file,
      content => Deferred('inline_epp', ['<%= $token %>', $vars])
    }
    $ truncate --size 0 /tmp/a.sh
    $ puppet apply --show_diff manifest.pp
    Notice: Compiled catalog for localhost in environment production in 0.01 seconds
    Notice: /Stage[main]/Main/File[/tmp/a.sh]/content:
    --- /tmp/a.sh	2024-07-03 17:30:37.024543314 -0700
    +++ /tmp/puppet-file20240703-1784698-2cu5s9	2024-07-03 17:30:41.880572413 -0700
    @@ -0,0 +1 @@
    +password
    \ No newline at end of file

The issue occurred because we were only checking if the outermost DeferredValue
contained any Sensitive arguments, in this case the arguments passed to
`inline_epp` function, but not the `password` passed to the `new` function.

This is not an issue when deferred values are preprocessed, because Deferred
values are completely resolved and we can check if resolved value is Sensitive.

(cherry picked from commit a94d5d0)
    @joshcooper
    joshcooper committed Jul 12, 2024
    Configuration menu
    Copy the full SHA
    20d1a37 View commit details
    Browse the repository at this point in the history