Repository navigation
cli: Redact CLI flags and env vars when writing debug bundle. - #28063
Merged
Merged
Conversation
The operator debug bundle writes out details of the CLI flags used to run the command, in order to provide additional context for support purposes. This process, however, did not perform any redaction of the values, so could include the raw data of ACL tokens used. This change performs redaction of CLI values before writing out the file in the debug bundle and includes ACL tokens as paths to TLS certificate keys for completeness.
jrasell
added
backport/ent/1.10.x+ent
tgross
approved these changes
May 28, 2026
Comment on lines
+1629
to
+1631
| // Square brackets are used deliberately: Go's encoding/json HTML-escapes angle | ||
| // brackets (< >) to Unicode escape sequences, which would make the placeholder | ||
| // unreadable in the resulting JSON file. |
Member
There was a problem hiding this comment.
The square brackets LGTM so whatever, but isn't this only the case if you call HTMLEscape? Are we doing that?
Member
Author
There was a problem hiding this comment.
The json.Marshal function sets HTMLEscape as true by default which I why I opted for this route. Without this, the file will contain the following example of data:
"consul-auth": {
"Name": "consul-auth",
"Value": "\u003credacted\u003e",
"DefValue": "\u003credacted\u003e",
"Usage": ""
},
Merged
6 tasks done
tehut
pushed a commit
that referenced
this pull request
Jun 12, 2026
The operator debug bundle writes out details of the CLI flags used to run the command, in order to provide additional context for support purposes. This process, however, did not perform any redaction of the values, so could include the raw data of ACL tokens used. This change performs redaction of CLI values before writing out the file in the debug bundle and includes ACL tokens as paths to TLS certificate keys for completeness.
schmichael
pushed a commit
to vercel/nomad
that referenced
this pull request
Sep 25, 2026
…orp#28063) The operator debug bundle writes out details of the CLI flags used to run the command, in order to provide additional context for support purposes. This process, however, did not perform any redaction of the values, so could include the raw data of ACL tokens used. This change performs redaction of CLI values before writing out the file in the debug bundle and includes ACL tokens as paths to TLS certificate keys for completeness.
|
I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The operator debug bundle writes out details of the CLI flags used to run the command, in order to provide additional context for support purposes. This process, however, did not perform any redaction of the values, so could include the raw data of ACL tokens used.
This change performs redaction of CLI values before writing out the file in the debug bundle and includes ACL tokens as paths to TLS certificate keys for completeness.
Links
https://hashicorp.atlassian.net/browse/SECVULN-43985
Contributor Checklist
changelog entry using the
make clcommand.ensure regressions will be caught.
and job configuration, please update the Nomad product documentation, which is stored in the
web-unified-docsrepo. Refer to theweb-unified-docscontributor guide for docs guidelines.Please also consider whether the change requires notes within the upgrade
guide. If you would like help with the docs, tag the
nomad-docsteam in this PR.Reviewer Checklist
backporting document.
in the majority of situations. The main exceptions are long-lived feature branches or merges where
history should be preserved.
within the public repository.