Skip to content
This repository was archived by the owner on May 14, 2025. It is now read-only.

Sanitize the history and exposed configuration #4964

Closed
corneil opened this issue Jun 28, 2022 · 1 comment
Closed

Sanitize the history and exposed configuration #4964

corneil opened this issue Jun 28, 2022 · 1 comment
Assignees
@corneil
Labels
status/in-progress Something is happening
Milestone
2.9.5

Comments

@corneil
Copy link
Contributor

corneil commented Jun 28, 2022

Hi guys,
Today I've seen another service who's exposing credentials or secrets.
From the dashboard on the stream deployment page, when a stream is deployed the dashboard retrieve stream history and manifests... informations are not hidden from services responses and displayed as is.
Get Deployment History i think, I'll check, https://docs.spring.io/spring-cloud-dataflow/docs/current/reference/htmlsingle/#api-guide-resources-stream-deployment-history
So i think that is more secure to create a http filter or a HandlerInterceptor to intercept all responses and sanitize them apart from the audit ?

Originally posted by @Hassen-BENNOUR in #4947 (comment)
@github-actions github-actions bot added the status/need-triage Team needs to triage and take a first look label Jun 28, 2022
@onobc onobc added this to the 2.9.5 milestone Jun 28, 2022
@corneil corneil self-assigned this Jun 28, 2022
@corneil corneil added status/in-progress Something is happening and removed status/need-triage Team needs to triage and take a first look labels Jun 29, 2022
@corneil corneil mentioned this issue Jun 29, 2022
Merged
corneil pushed a commit that referenced this issue Jun 30, 2022
Add sanitizer to history output. (#4968)
439f26a 
Fixes - #4964
This was referenced Jul 1, 2022
Closed
Merged
onobc pushed a commit that referenced this issue Jul 1, 2022
Sanitize stream history data (backport #4964)
e9b08b4
@corneil
Copy link
Contributor Author

corneil commented Jul 6, 2022

Merged on Main and 2.9.x

@corneil corneil closed this as completed Jul 6, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@corneil corneil

Labels
status/in-progress Something is happening
Milestone
2.9.5
Development

No branches or pull requests
2 participants
@corneil @onobc