Builds: obfuscate Git clone token in build command output - #13239
Draft
ericholscher wants to merge 1 commit into
Draft
Builds: obfuscate Git clone token in build command output#13239ericholscher wants to merge 1 commit into
ericholscher wants to merge 1 commit into
Conversation
The token used to clone private repositories could show up in the recorded build output (e.g. a command echoing the remote URL or the environment). Obfuscate it like we already do for private environment variables. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FQsmfAx7JW6ze8rkBqeCP9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A user's build output exposed the clone token used for private repositories. The token is passed to the checkout step via the
READTHEDOCS_GIT_CLONE_TOKENenvironment variable and ends up stored in.git/configas part of the remote URL, so any command that echoes the environment or the remote URL (e.g.git remote -v) writes it into the recorded build output, which is visible on the build page.This obfuscates the token at the point where command output is saved (
BuildCommand.sanitize_output), the same way we already handle private environment variables. Both the full<username>:<secret>value and the bare secret part are replaced, covering the remote-URL form and the env-var form.Things a reviewer may want to double-check:
contents:readand expires after one hour, so the masking is about keeping it out of (potentially public) build logs rather than the only line of defense..git/config, revoking it after checkout) were intentionally left out since the build process is moving externally.🤖 Generated with Claude Code
https://claude.ai/code/session_01FQsmfAx7JW6ze8rkBqeCP9
Generated by Claude Code