mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-08-06 06:37:02 +02:00
Code Issues Projects Releases Wiki Activity

Fix the exposure of sensitive data from inside logs by dropping the entered value inside schema validation function (#30388)

Browse Source 
* drop the actual value of the secret entered by the user from printing inside field validation

* add changelog

* upgrade vault radar version to 0.24.0

* feedback

* remove changelog
This commit is contained in:
Amir Aslamov 2025-04-25 15:20:29 -04:00 committed by GitHub
parent f8ab6471d6
commit 10495d77f3
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
enos/modules/verify_log_secrets/main.tf
View File

@ -34,7 +34,7 @@ variable "radar_license_path" {
variable "radar_version" {
description = "The version of Vault Radar to install"
default = "0.17.0" # must be >= 0.17.0
default = "0.24.0" # must be >= 0.17.0
// NOTE: A `semverconstraint` validation condition would be very useful here
// when we get around to exporting our custom enos funcs in the provider.
}

4
sdk/framework/field_data.go
View File

@ -33,7 +33,7 @@ type FieldData struct {
// trying to get data out. Data not in the schema is not
// an error at this point, so we don't worry about it.
func (d *FieldData) Validate() error {
for field, value := range d.Raw {
for field := range d.Raw {
schema, ok := d.Schema[field]
if !ok {
@ -46,7 +46,7 @@ func (d *FieldData) Validate() error {
TypeKVPairs, TypeCommaIntSlice, TypeHeader, TypeFloat, TypeTime:
_, _, err := d.getPrimitive(field, schema)
if err != nil {
return errwrap.Wrapf(fmt.Sprintf("error converting input %v for field %q: {{err}}", value, field), err)
return errwrap.Wrapf(fmt.Sprintf("error converting input for field %q: {{err}}", field), err)
}
default:
return fmt.Errorf("unknown field type %q for field %q", schema.Type, field)