fix(release): redact the token in the GitHub and GitLab release error output - #36852
Open
AgentEnder wants to merge 1 commit into
Open
fix(release): redact the token in the GitHub and GitLab release error output#36852AgentEnder wants to merge 1 commit into
AgentEnder wants to merge 1 commit into
Conversation
… output - The API-error output printed `Token Header Data: [object Object]`. It never leaked a token, but it read as a formatting bug and the obvious fix (`JSON.stringify`, as the adjacent `Body:` line does) would have written the bearer token to CI logs. - Print the header name with the value redacted instead, or `none` when no token was configured, so a failing release still shows which credential source was used. - Add specs for both clients asserting the token never appears in the output. Flagged by the Socket gptSecurity analysis of nx 23.1.2.
✅ Deploy Preview for nx-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for nx-dev ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
Nx Cloud AI Fix could not be generatedView your CI Pipeline Execution ↗ for commit 53ecee6
☁️ Nx Cloud last updated this comment at |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Current Behavior
When creating a GitHub or GitLab release fails, the error output includes
Token Header Data: [object Object]. It doesn't leak the token today, but it reads like a formatting bug, and the obvious fix (JSON.stringify, like theBody:line next to it) would print the bearer token in CI logs.Expected Behavior
The line names the header the token was sent under, with the value redacted:
Token Header: Authorization: Bearer <redacted>, orToken Header: nonewhen no token was configured. Specs assert the token itself never appears.Related Issue(s)
Fixes #
NXC-4910, raised by https://socket.dev/npm/package/nx/alerts/23.1.2?alert_name=gptSecurity
View Polygraph session ↗