diff options
| author | Sam Thursfield <sam@afuera.me.uk> | 2014-08-29 10:20:13 +0000 |
|---|---|---|
| committer | Sam Thursfield <sam@afuera.me.uk> | 2014-09-19 14:32:56 +0000 |
| commit | 359248a35948d2060dba97ef7073c155e3b9c1bb (patch) | |
| tree | f3794295153601b58a12c0576a12e3a89b0f6063 /morphlib/plugins/deploy_plugin.py | |
| parent | a32de7934cce79dda2b8dc20be1c5ec94109869e (diff) | |
| download | morph-359248a35948d2060dba97ef7073c155e3b9c1bb.tar.gz | |
Don't log environment variables with 'PASSWORD' in their name.
This involved rewriting the util.log_dict_diff() function. It has been
renamed to log_environment_changes() to better reflect its purpose.
It no longer logs both the old and new values in the event of an
environment variable changing. It now just logs the new value. This makes
the code simpler and seems like it should not be a big problem.
Some projects recommend passing credentials through the environment.
OpenStack does this, for example, see:
<http://docs.openstack.org/user-guide/content/cli_openrc.html>
It's unlikely that users would be happy about applications saving
these passwords in log files all over their system.
I do not recommend ever storing valuable passwords in the environment.
Diffstat (limited to 'morphlib/plugins/deploy_plugin.py')
| -rw-r--r-- | morphlib/plugins/deploy_plugin.py | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/morphlib/plugins/deploy_plugin.py b/morphlib/plugins/deploy_plugin.py index a80079fa..2bc53a0d 100644 --- a/morphlib/plugins/deploy_plugin.py +++ b/morphlib/plugins/deploy_plugin.py @@ -591,8 +591,7 @@ class DeployPlugin(cliapp.Plugin): ''' def remove_passwords(env): - def is_password(key): - return 'PASSWORD' in key + is_password = morphlib.util.env_variable_is_password return { k:v for k, v in env.iteritems() if not is_password(k) } meta = { |