🛡️ security(VSecM): remove printAdditionalDetails from envInfo (#1071)

printAdditionalDetails is able to print arbitrary information about all environment variables. Giving too much info can be used as an aid to a possible attack vector; especially if environment is misconfigured. Signed-off-by: Volkan Özçelik <[email protected]>
vmware-tanzu · Jul 14, 2024 · f85a253 · f85a253
1 parent 501a304
commit f85a253
Show file tree

Hide file tree

Showing 2 changed files with 0 additions and 16 deletions.
diff --git a/core/log/std/augment.go b/core/log/std/augment.go
@@ -12,12 +12,6 @@ package std
 
 import (
 	"os"
-	"runtime"
-	"strings"
-
-	"github.com/vmware-tanzu/secrets-manager/core/constants/key"
-	"github.com/vmware-tanzu/secrets-manager/core/env"
-	"github.com/vmware-tanzu/secrets-manager/core/log/level"
 )
 
 func updateInfoWithExpectedEnvVars(
@@ -35,11 +29,3 @@ func updateInfoWithExpectedEnvVars(
 
 	return nf
 }
-
-func appendAdditionalDetails(info map[string]string) {
-	if env.LogLevel() >= int(level.Trace) {
-		info[key.EnvVars] = strings.Join(envVars(), ", ")
-	}
-
-	info[key.GoVersion] = runtime.Version()
-}
diff --git a/core/log/std/envinfo.go b/core/log/std/envinfo.go
@@ -20,7 +20,5 @@ func PrintEnvironmentInfo(id *string, envVarsToExpect []string) {
 		WarnLn(id, "Environment variable '"+v+"' not found")
 	}
 
-	appendAdditionalDetails(info)
-
 	printFormattedInfo(id, info)
 }