opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: redact env var values in agent debug manifest endpoint (#26904)

Browse Source
This commit is contained in:
Jon Ayers
2026-07-01 10:46:35 -05:00
committed by GitHub
parent 679eb00ec4
commit b33ff2d851
2 changed files with 55 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agent/agent_test.go
+32
View File
@@ -3672,6 +3672,10 @@ func TestAgent_DebugServer(t *testing.T) {
//nolint:dogsled
conn, _, _, _, agnt := setupAgentWithSecrets(t, agentsdk.Manifest{
DERPMap: derpMap,
EnvironmentVariables: map[string]string{
"AWS_SECRET_ACCESS_KEY": "env-value-should-be-redacted-67890",
"EMPTY_VAR": "",
},
}, []agentsdk.WorkspaceSecret{
{EnvName: "DEBUG_SECRET", Value: []byte("super-secret-value-12345")},
}, 0, func(c *agenttest.Client, o *agent.Options) {
@@ -3800,6 +3804,34 @@ func TestAgent_DebugServer(t *testing.T) {
require.NoError(t, json.Unmarshal(body, &v))
})
t.Run("ManifestEnvVarValuesRedacted", func(t *testing.T) {
t.Parallel()
ctx := testutil.Context(t, testutil.WaitLong)
req, err := http.NewRequestWithContext(ctx, http.MethodGet, srv.URL+"/debug/manifest", nil)
require.NoError(t, err)
res, err := srv.Client().Do(req)
require.NoError(t, err)
defer res.Body.Close()
require.Equal(t, http.StatusOK, res.StatusCode)
body, err := io.ReadAll(res.Body)
require.NoError(t, err)
require.NotContains(t, string(body), "env-value-should-be-redacted-67890")
var v agentsdk.Manifest
require.NoError(t, json.Unmarshal(body, &v))
require.Contains(t, v.EnvironmentVariables, "AWS_SECRET_ACCESS_KEY")
require.Equal(t, "***REDACTED***", v.EnvironmentVariables["AWS_SECRET_ACCESS_KEY"])
// Empty values carry no secret and are preserved as empty.
require.Contains(t, v.EnvironmentVariables, "EMPTY_VAR")
require.Equal(t, "", v.EnvironmentVariables["EMPTY_VAR"])
})
t.Run("Logs", func(t *testing.T) {
t.Parallel()