lordran
opened 1 year ago
-
As long as user has permission to access job secret from build spec crafted by him, the user can get the secret value even if it is masked in log. For instance, they can modify the job to write secret into a text file and then publish the text file as artifacts.
To protect the job secret from seen by certain code writers, you should configure secret authorization to only allow it to be accessible from protected branches requiring reviews from those code writers.
-
Hi, @robin
“they can modify the job to write secret into a text file and then publish the text file as artifacts”，indeed，I have tested before.
Yet another question: if the job secret should be masked in build log? I tested and print the unmasked content as described above.
BTW, is there a way to set global configurations or secrets? We have many parent projects, we must set the same secret again and again :(
-
Secret with multi-line can not be masked in build log, and I will add note for that. You may define job secret in parent project, and all child projects will be able to use that.
-
“You may define job secret in parent project, and all child projects will be able to use that”，yes，but we have many parent projects. 😟
-
You may consider create a root project, and move all parent projects under this root project.
-
Previous Value Current Value Open
Closed
| Type |
Bug
|
| Priority |
Normal
|
| Assignee | |
| Affected Versions |
11.6.6
|
| Labels |
No labels
|
I created a user with code writer role for testing.
How to let the user can read and write code, and start job, but forbiden to see job secrets used by job and including param with a secret type. If I restrict the job secret like specific branch or group or user, job secrets still can be see:
just when starting the job will cause a authorization error.
The user is a code writer, so he can write their own job( actually write .onedev-buildspec.yml ), and print job secrets in a step. I know "Note that secret value less than 5 characters will not be masked in build log", but I can still print kubeconfig(far large than 5) in a test step:
Please check this.
OneDev version: 11.6.6