fix(security): clear env vars

semaphoreui · Oct 21, 2024 · 5822ed1 · 5822ed1
1 parent 089a10a
commit 5822ed1
Show file tree

Hide file tree

Showing 4 changed files with 3 additions and 35 deletions.
diff --git a/db_lib/AnsiblePlaybook.go b/db_lib/AnsiblePlaybook.go
@@ -22,7 +22,7 @@ func (p AnsiblePlaybook) makeCmd(command string, args []string, environmentVars
 	cmd := exec.Command(command, args...) //nolint: gas
 	cmd.Dir = p.GetFullPath()
 
-	cmd.Env = removeSensitiveEnvs(os.Environ())
+	cmd.Env = string[]{}
 
 	cmd.Env = append(cmd.Env, fmt.Sprintf("HOME=%s", util.Config.TmpPath))
 	cmd.Env = append(cmd.Env, fmt.Sprintf("PWD=%s", cmd.Dir))

diff --git a/db_lib/LocalApp.go b/db_lib/LocalApp.go
@@ -7,38 +7,6 @@ import (
 	"github.com/ansible-semaphore/semaphore/pkg/task_logger"
 )
 
-func isSensitiveVar(v string) bool {
-	sensitives := []string{
-		"SEMAPHORE_ACCESS_KEY_ENCRYPTION",
-		"SEMAPHORE_ADMIN_PASSWORD",
-		"SEMAPHORE_DB_USER",
-		"SEMAPHORE_DB_NAME",
-		"SEMAPHORE_DB_HOST",
-		"SEMAPHORE_DB_PASS",
-		"SEMAPHORE_LDAP_PASSWORD",
-		"SEMAPHORE_RUNNER_TOKEN",
-		"SEMAPHORE_RUNNER_ID",
-	}
-
-	for _, s := range sensitives {
-		if strings.HasPrefix(v, s+"=") {
-			return true
-		}
-	}
-
-	return false
-}
-
-func removeSensitiveEnvs(envs []string) (res []string) {
-
-	for _, e := range envs {
-		if !isSensitiveVar(e) {
-			res = append(res, e)
-		}
-	}
-
-	return res
-}
 
 type LocalApp interface {
 	SetLogger(logger task_logger.Logger) task_logger.Logger

diff --git a/db_lib/ShellApp.go b/db_lib/ShellApp.go
@@ -44,7 +44,7 @@ func (t *ShellApp) makeCmd(command string, args []string, environmentVars *[]str
 	cmd := exec.Command(command, args...) //nolint: gas
 	cmd.Dir = t.GetFullPath()
 
-	cmd.Env = removeSensitiveEnvs(os.Environ())
+	cmd.Env = string[]{}
 	cmd.Env = append(cmd.Env, fmt.Sprintf("HOME=%s", util.Config.TmpPath))
 	cmd.Env = append(cmd.Env, fmt.Sprintf("PWD=%s", cmd.Dir))
 

diff --git a/db_lib/TerraformApp.go b/db_lib/TerraformApp.go
@@ -37,7 +37,7 @@ func (t *TerraformApp) makeCmd(command string, args []string, environmentVars *[
 	cmd := exec.Command(command, args...) //nolint: gas
 	cmd.Dir = t.GetFullPath()
 
-	cmd.Env = removeSensitiveEnvs(os.Environ())
+	cmd.Env = string[]{}
 	cmd.Env = append(cmd.Env, fmt.Sprintf("HOME=%s", util.Config.TmpPath))
 	cmd.Env = append(cmd.Env, fmt.Sprintf("PWD=%s", cmd.Dir))