Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WIP -- How would we hide the display on /tests/$id#settings pages? -- Add support for configurable secrets variables #5691

Draft
wants to merge 2 commits into
base: master
Choose a base branch
from
+15 −2
Draft

WIP -- How would we hide the display on /tests/$id#settings pages? -- Add support for configurable secrets variables #5691

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4c94cca
t: Fix unhandled log output in 24-worker-jobs.t
okurz Jun 11, 2024
3b7630f
WIP -- How would we hide the display on /tests/$id#settings pages? --…
okurz Jun 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion lib/OpenQA/Log.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,8 +208,13 @@ sub setup_log ($app, $logfile = undef, $logdir = undef, $level = undef) {
OpenQA::App->set_singleton($app);
}

# same approach as in os-autoinst bmwqemu.pm
sub redact_settings ($vars) {
return {map { $_ !~ qr/(^_SECRET_|_PASSWORD)/ ? ($_ => $vars->{$_}) : ($_ => '[redacted]') } keys %$vars};
my $hide_re = '^_SECRET_|_PASSWORD';
my $custom_hide_re = eval { qr/$vars->{_HIDE_SECRETS_REGEX}/ } if $vars->{_HIDE_SECRETS_REGEX};
$vars->{_HIDE_SECRETS_REGEX} = "(invalid regex specified: $@)" if $@;
$hide_re .= "|$custom_hide_re" if $custom_hide_re;
return {map { /($hide_re)/ ? ($_ => '[redacted]') : ($_ => $vars->{$_}) } keys %$vars};
}

sub redact_settings_in_file ($file) {
Expand Down
3 changes: 2 additions & 1 deletion t/24-worker-jobs.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1212,7 +1212,8 @@ subtest 'optipng' => sub {
};

subtest 'pngquant' => sub {
is OpenQA::Worker::Job::_optimize_image('foo', {USE_PNGQUANT => 1}), undef, 'pngquant call is "best-effort"';
combined_like { OpenQA::Worker::Job::_optimize_image('foo', {USE_PNGQUANT => 1}) } qr/cannot open foo for reading/,
'pngquant call is "best-effort"';
};

subtest '_read_module_result' => sub {
Expand Down
7 changes: 7 additions & 0 deletions t/28-logging.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ use OpenQA::Worker::App;
use File::Path qw(make_path remove_tree);
use Test::MockModule qw(strict);
use Test::Output qw(stdout_like stderr_like stdout_from stderr_from);
use Test::Fatal;
use Sys::Hostname;
use File::Spec::Functions 'catfile';
use FindBin;
Expand Down Expand Up @@ -579,6 +580,12 @@ subtest 'Formatting settings' => sub {
like $log, qr/FOO=bar.*THE_PASSWORD.*_SECRET_TOKEN/s, 'all keys and normal values present';
unlike $log, qr/token/, 'secret token not present';
unlike $log, qr/123/, 'password not present';
$log
= format_settings {FOO => 'bar', SNEAKY_TEXT => 'secret', _HIDE_SECRETS_REGEX => 'SNEAK', _SECRET_KEY => 'foo'};
like $log, qr/FOO=bar.*SNEAKY.*HIDE.*_SECRET_KEY/s, 'keys and normal values present with customized hiding';
unlike $log, qr/secret/, 'value of custom secret key not present';
$log = format_settings {_HIDE_SECRETS_REGEX => '['};
like $log, qr/invalid regex.*Unmatched \[/, 'invalid hide regex yields non-critical error information';
};

ok get_channel_handle, 'get_channel_handle returns valid handle from app';
Expand Down
Loading