Skip to content

Commit e2ba38b

Browse files
Add new log level (closes distributhor#21)
Adds a new log level between `--verbose` and `--silent`. Defaults to the new log level. Added new option `verbose` that re-enables verbose output (previous default) if set to `true`. This allows easier debugging without entirely compromising on privacy and security (domain, IP addresses etc.). For more details see distributhor#21. This also reduces the propability of replay attacks as mentioned in distributhor#22, as the signatures are no longer logged by default.
1 parent ce480c3 commit e2ba38b

File tree

3 files changed

+13
-3
lines changed

3 files changed

+13
-3
lines changed

README.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,14 @@ authentication is assumed not to be required. If configured, it must follow the
163163
The default endpoint type is JSON. The argument is only required if you wish to send urlencoded form data.
164164
Otherwise it's optional. <br/><br/>
165165

166+
```yml
167+
verbose: true
168+
```
169+
170+
To enable verbose output in curl set the argument `verbose` to `true`. The default value is `false`. See also: [`curl` docs on option `-v`](https://curl.se/docs/manpage.html#-v).
171+
172+
:warning: **Warning:** This might lead to domain and IP leaking, as well as other security issues as the logs are public. See also [#21](https://github.com/distributhor/workflow-webhook/issues/21) and [#22](https://github.com/distributhor/workflow-webhook/issues/22). :warning:<br/><br/>
173+
166174

167175
```yml
168176
silent: true

action.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ inputs:
1111
description: 'Credentials to be used for BASIC authentication (optional)'
1212
webhook_type:
1313
description: 'json | form-urlencoded | json-extended'
14+
verbose:
15+
description: 'Optional, set to true to enable verbose output. Warning: this might lead to domain and IP leaking, as well as other security issues as the logs are public.'
1416
silent:
1517
description: 'Optional, set to true to disable output and therefore IP leaking'
1618
data:

entrypoint.sh

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -73,10 +73,10 @@ fi
7373

7474
options="--http1.1 --fail -k"
7575

76-
if [ "$silent" ]; then
77-
options="$options -s"
78-
else
76+
if [ "$verbose" = true ]; then
7977
options="$options -v"
78+
elif [ "$silent" = true ]; then
79+
options="$options -s"
8080
fi
8181

8282
curl $options \

0 commit comments

Comments
 (0)