GitLab Access token exposed in Sentry notification emails

[syphernl]

Environment

SaaS (https://sentry.io/)

Steps to Reproduce

1. Create a release (using the API, in our case trough semantic-release)
2. A notification email is sent out (e.g. Re: Deployed version 1.7.1 to production)
3. Underneath the Commits section a field is shown with the full URL visible (https://gitlab-ci-token:[email protected]). In an earlier release it showed the repository path (in sentry-style)

Expected Result

No access tokens to be exposed in notification emails sent out

Actual Result

Product Area

Releases

Link

No response

DSN

No response

Version

No response

[getsantry]

Assigning to @getsentry/support for routing ⏲️

[mdtro]

@syphernl -- I'm looking in to this issue.
Could you be making commits with that URL as the commit author (ie. user.email or user.name in the gitconfig)?

The template for this email hasn't change in quite some time.

sentry/src/sentry/templates/sentry/emails/activity/release.html

Lines 58 to 69 in 0c743bb

	<td class="avatar-column">
	{% if user %}
	{% if user.get_avatar_type == 'upload' %}
	<img class="avatar" src="{% profile_photo_url user.id 36 %}">
	{% elif user.get_avatar_type == 'letter_avatar' %}
	{% email_avatar user.get_display_name user.get_label 36 False %}
	{% else %}
	{% email_avatar user.get_display_name user.get_label 36 %}
	{% endif %}
	{% elif commit.author %}
	{% email_avatar commit.author.name commit.author.get_label 36 %}
	{% else %}

[syphernl]

@mdtro I noticed there were 3 repositories added without a name (in Sentry-format, e.g. Foo / Bar / Baz) but with the GitLab URL (including the token).
Since we just introduced Sentry release creation using semantic-release-sentry-releases this probably somehow triggered this repository to be added to Sentry as such.

[getsantry]

Routing to @getsentry/product-owners-settings-security-privacy for triage ⏲️

[mdtro]

@syphernl --

Ah, I linked the wrong lines of the template. Yes, this is intended to be the repository name.

sentry/src/sentry/templates/sentry/emails/activity/release.html

Line 54 in 0c743bb

<th class="lowercase" colspan="3">{{ repo.name }}</th>

SpikeeLabs/semantic-release-sentry-releases is not maintained by Sentry. I do see in their README though that the repository URL/name has some default behavior I suspect you may be running in to (see below).

https://github.com/SpikeeLabs/semantic-release-sentry-releases/blob/6c316ee8cf52f8c93800b4811ea10b8b4f284aa8/README.md?plain=1#L60

Let me know if you still experience the same issue after updating your configuration. I'll keep this issue open for now.