From 85c99cc38a599c16c6489dfa111287384e125f06 Mon Sep 17 00:00:00 2001 From: AlanCoding Date: Wed, 2 Oct 2019 11:46:47 -0400 Subject: [PATCH] Redact env vars for Galaxy token or password --- awx/main/models/credential/__init__.py | 2 +- awx/main/tests/unit/test_tasks.py | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/awx/main/models/credential/__init__.py b/awx/main/models/credential/__init__.py index 7c84226d7d..ce3295cc69 100644 --- a/awx/main/models/credential/__init__.py +++ b/awx/main/models/credential/__init__.py @@ -64,7 +64,7 @@ def build_safe_env(env): for k, v in safe_env.items(): if k == 'AWS_ACCESS_KEY_ID': continue - elif k.startswith('ANSIBLE_') and not k.startswith('ANSIBLE_NET'): + elif k.startswith('ANSIBLE_') and not k.startswith('ANSIBLE_NET') and not k.startswith('ANSIBLE_GALAXY_SERVER'): continue elif hidden_re.search(k): safe_env[k] = HIDDEN_PASSWORD diff --git a/awx/main/tests/unit/test_tasks.py b/awx/main/tests/unit/test_tasks.py index 4c49af8b5d..77c13fffd2 100644 --- a/awx/main/tests/unit/test_tasks.py +++ b/awx/main/tests/unit/test_tasks.py @@ -130,6 +130,8 @@ def test_send_notifications_list(mock_notifications_filter, mock_job_get, mocker ('VMWARE_PASSWORD', 'SECRET'), ('API_SECRET', 'SECRET'), ('CALLBACK_CONNECTION', 'amqp://tower:password@localhost:5672/tower'), + ('ANSIBLE_GALAXY_SERVER_PRIMARY_GALAXY_PASSWORD', 'SECRET'), + ('ANSIBLE_GALAXY_SERVER_PRIMARY_GALAXY_TOKEN', 'SECRET'), ]) def test_safe_env_filtering(key, value): assert build_safe_env({key: value})[key] == tasks.HIDDEN_PASSWORD