Skip to content
This repository was archived by the owner on Sep 30, 2024. It is now read-only.

Commit f39f062

Browse files
indradhanushindradhanush
authored
internal/conf: Redact Azure DevOps client secret (#49431)
1 parent 14867a4 commit f39f062

File tree

2 files changed

+162
-88
lines changed

2 files changed

+162
-88
lines changed

‎internal/conf/validate.go

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,7 +226,7 @@ var siteConfigSecrets = []struct {
226226
// UnredactSecrets unredacts unchanged secrets back to their original value for
227227
// the given configuration.
228228
//
229-
// Updates to this function should also being reflected in the RedactSecrets.
229+
// Updates to this function should also be reflected in the RedactSecrets.
230230
func UnredactSecrets(input string, raw conftypes.RawUnified) (string, error) {
231231
oldCfg, err := ParseConfig(raw)
232232
if err != nil {
@@ -247,6 +247,9 @@ func UnredactSecrets(input string, raw conftypes.RawUnified) (string, error) {
247247
if ap.Bitbucketcloud != nil {
248248
oldSecrets[ap.Bitbucketcloud.ClientKey] = ap.Bitbucketcloud.ClientSecret
249249
}
250+
if ap.AzureDevOps != nil {
251+
oldSecrets[ap.AzureDevOps.ClientID] = ap.AzureDevOps.ClientSecret
252+
}
250253
}
251254

252255
newCfg, err := ParseConfig(conftypes.RawUnified{
@@ -268,6 +271,9 @@ func UnredactSecrets(input string, raw conftypes.RawUnified) (string, error) {
268271
if ap.Bitbucketcloud != nil && ap.Bitbucketcloud.ClientSecret == redactedSecret {
269272
ap.Bitbucketcloud.ClientSecret = oldSecrets[ap.Bitbucketcloud.ClientKey]
270273
}
274+
if ap.AzureDevOps != nil && ap.AzureDevOps.ClientSecret == redactedSecret {
275+
ap.AzureDevOps.ClientSecret = oldSecrets[ap.AzureDevOps.ClientID]
276+
}
271277
}
272278
unredactedSite, err := jsonc.Edit(input, newCfg.AuthProviders, "auth.providers")
273279
if err != nil {
@@ -335,6 +341,9 @@ func redactConfSecrets(raw conftypes.RawUnified, hashSecrets bool) (empty confty
335341
if ap.Bitbucketcloud != nil {
336342
ap.Bitbucketcloud.ClientSecret = getRedactedSecret(ap.Bitbucketcloud.ClientSecret)
337343
}
344+
if ap.AzureDevOps != nil {
345+
ap.AzureDevOps.ClientSecret = getRedactedSecret(ap.AzureDevOps.ClientSecret)
346+
}
338347
}
339348
redactedSite := raw.Site
340349
if len(cfg.AuthProviders) > 0 {

‎internal/conf/validate_test.go

Lines changed: 152 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ const (
1818
authOpenIDClientSecret = "authOpenIDClientSecret"
1919
authGitHubClientSecret = "authGitHubClientSecret"
2020
authGitLabClientSecret = "authGitLabClientSecret"
21+
authAzureDevOpsClientSecret = "authAzureDevOpsClientSecret"
2122
emailSMTPPassword = "emailSMTPPassword"
2223
organizationInvitationsSigningKey = "organizationInvitationsSigningKey"
2324
githubClientSecret = "githubClientSecret"
@@ -216,16 +217,21 @@ func TestRedactSecrets(t *testing.T) {
216217
redacted, err := RedactSecrets(
217218
conftypes.RawUnified{
218219
Site: getTestSiteWithSecrets(
219-
executorsAccessToken,
220-
authOpenIDClientSecret, authGitLabClientSecret, authGitHubClientSecret,
221-
emailSMTPPassword,
222-
organizationInvitationsSigningKey,
223-
githubClientSecret,
224-
dotcomGitHubAppCloudClientSecret,
225-
dotcomGitHubAppCloudPrivateKey,
226-
dotcomSrcCliVersionCacheGitHubToken,
227-
dotcomSrcCliVersionCacheGitHubWebhookSecret,
228-
authUnlockAccountLinkSigningKey,
220+
testSecrets{
221+
executorsAccessToken: executorsAccessToken,
222+
authOpenIDClientSecret: authOpenIDClientSecret,
223+
authGitLabClientSecret: authGitLabClientSecret,
224+
authGitHubClientSecret: authGitHubClientSecret,
225+
authAzureDevOpsClientSecret: authAzureDevOpsClientSecret,
226+
emailSMTPPassword: emailSMTPPassword,
227+
organizationInvitationsSigningKey: organizationInvitationsSigningKey,
228+
githubClientSecret: githubClientSecret,
229+
dotcomGitHubAppCloudClientSecret: dotcomGitHubAppCloudClientSecret,
230+
dotcomGitHubAppCloudPrivateKey: dotcomGitHubAppCloudPrivateKey,
231+
dotcomSrcCliVersionCacheGitHubToken: dotcomSrcCliVersionCacheGitHubToken,
232+
dotcomSrcCliVersionCacheGitHubWebhookSecret: dotcomSrcCliVersionCacheGitHubWebhookSecret,
233+
authUnlockAccountLinkSigningKey: authUnlockAccountLinkSigningKey,
234+
},
229235
),
230236
},
231237
)
@@ -262,26 +268,26 @@ func TestRedactConfSecrets(t *testing.T) {
262268

263269
testCases := []struct {
264270
name string
265-
hasSecrets bool
271+
hashSecrets bool
266272
redactedFmtStr string
267273
}{
268274
{
269-
name: "hasSecrets true",
270-
hasSecrets: true,
275+
name: "hashSecrets true",
276+
hashSecrets: true,
271277
// This is the first 10 chars of the SHA256 of "strongsecret". See this go playground to
272278
// verify: https://go.dev/play/p/N-4R4_fO9XI.
273279
redactedFmtStr: "REDACTED-DATA-CHUNK-f434ecc765",
274280
},
275281
{
276-
name: "hasSecrets false",
277-
hasSecrets: false,
282+
name: "hashSecrets false",
283+
hashSecrets: false,
278284
redactedFmtStr: "REDACTED",
279285
},
280286
}
281287

282288
for _, tc := range testCases {
283289
t.Run(tc.name, func(t *testing.T) {
284-
redacted, err := redactConfSecrets(conftypes.RawUnified{Site: conf}, tc.hasSecrets)
290+
redacted, err := redactConfSecrets(conftypes.RawUnified{Site: conf}, tc.hashSecrets)
285291
require.NoError(t, err)
286292

287293
want := fmt.Sprintf(want, tc.redactedFmtStr)
@@ -307,16 +313,21 @@ func TestRedactSecrets_AuthProvidersSectionNotAdded(t *testing.T) {
307313

308314
func TestUnredactSecrets(t *testing.T) {
309315
previousSite := getTestSiteWithSecrets(
310-
executorsAccessToken,
311-
authOpenIDClientSecret, authGitLabClientSecret, authGitHubClientSecret,
312-
emailSMTPPassword,
313-
organizationInvitationsSigningKey,
314-
githubClientSecret,
315-
dotcomGitHubAppCloudClientSecret,
316-
dotcomGitHubAppCloudPrivateKey,
317-
dotcomSrcCliVersionCacheGitHubToken,
318-
dotcomSrcCliVersionCacheGitHubWebhookSecret,
319-
authUnlockAccountLinkSigningKey,
316+
testSecrets{
317+
executorsAccessToken: executorsAccessToken,
318+
authOpenIDClientSecret: authOpenIDClientSecret,
319+
authGitLabClientSecret: authGitLabClientSecret,
320+
authGitHubClientSecret: authGitHubClientSecret,
321+
authAzureDevOpsClientSecret: authAzureDevOpsClientSecret,
322+
emailSMTPPassword: emailSMTPPassword,
323+
organizationInvitationsSigningKey: organizationInvitationsSigningKey,
324+
githubClientSecret: githubClientSecret,
325+
dotcomGitHubAppCloudClientSecret: dotcomGitHubAppCloudClientSecret,
326+
dotcomGitHubAppCloudPrivateKey: dotcomGitHubAppCloudPrivateKey,
327+
dotcomSrcCliVersionCacheGitHubToken: dotcomSrcCliVersionCacheGitHubToken,
328+
dotcomSrcCliVersionCacheGitHubWebhookSecret: dotcomSrcCliVersionCacheGitHubWebhookSecret,
329+
authUnlockAccountLinkSigningKey: authUnlockAccountLinkSigningKey,
330+
},
320331
)
321332

322333
t.Run("replaces REDACTED with corresponding secret", func(t *testing.T) {
@@ -329,87 +340,129 @@ func TestUnredactSecrets(t *testing.T) {
329340

330341
t.Run("unredacts secrets AND respects specified edits to secret", func(t *testing.T) {
331342
input := getTestSiteWithSecrets(
332-
"new"+executorsAccessToken,
333-
redactedSecret, "new"+authGitLabClientSecret, redactedSecret,
334-
redactedSecret,
335-
redactedSecret,
336-
redactedSecret,
337-
redactedSecret,
338-
redactedSecret,
339-
redactedSecret,
340-
redactedSecret,
341-
redactedSecret,
343+
testSecrets{
344+
executorsAccessToken: "new" + executorsAccessToken,
345+
authOpenIDClientSecret: redactedSecret,
346+
authGitLabClientSecret: "new" + authGitLabClientSecret,
347+
authGitHubClientSecret: redactedSecret,
348+
authAzureDevOpsClientSecret: redactedSecret,
349+
emailSMTPPassword: redactedSecret,
350+
organizationInvitationsSigningKey: redactedSecret,
351+
githubClientSecret: redactedSecret,
352+
dotcomGitHubAppCloudClientSecret: redactedSecret,
353+
dotcomGitHubAppCloudPrivateKey: redactedSecret,
354+
dotcomSrcCliVersionCacheGitHubToken: redactedSecret,
355+
dotcomSrcCliVersionCacheGitHubWebhookSecret: redactedSecret,
356+
authUnlockAccountLinkSigningKey: redactedSecret,
357+
},
342358
)
343359
unredactedSite, err := UnredactSecrets(input, conftypes.RawUnified{Site: previousSite})
344360
require.NoError(t, err)
345361

346362
// Expect to have newly-specified secrets and to fill in "REDACTED" secrets with secrets from previous site
347363
want := getTestSiteWithSecrets(
348-
"new"+executorsAccessToken,
349-
authOpenIDClientSecret, "new"+authGitLabClientSecret, authGitHubClientSecret,
350-
emailSMTPPassword,
351-
organizationInvitationsSigningKey,
352-
githubClientSecret,
353-
dotcomGitHubAppCloudClientSecret,
354-
dotcomGitHubAppCloudPrivateKey,
355-
dotcomSrcCliVersionCacheGitHubToken,
356-
dotcomSrcCliVersionCacheGitHubWebhookSecret,
357-
authUnlockAccountLinkSigningKey,
364+
testSecrets{
365+
executorsAccessToken: "new" + executorsAccessToken,
366+
authOpenIDClientSecret: authOpenIDClientSecret,
367+
authGitLabClientSecret: "new" + authGitLabClientSecret,
368+
authGitHubClientSecret: authGitHubClientSecret,
369+
authAzureDevOpsClientSecret: authAzureDevOpsClientSecret,
370+
emailSMTPPassword: emailSMTPPassword,
371+
organizationInvitationsSigningKey: organizationInvitationsSigningKey,
372+
githubClientSecret: githubClientSecret,
373+
dotcomGitHubAppCloudClientSecret: dotcomGitHubAppCloudClientSecret,
374+
dotcomGitHubAppCloudPrivateKey: dotcomGitHubAppCloudPrivateKey,
375+
dotcomSrcCliVersionCacheGitHubToken: dotcomSrcCliVersionCacheGitHubToken,
376+
dotcomSrcCliVersionCacheGitHubWebhookSecret: dotcomSrcCliVersionCacheGitHubWebhookSecret,
377+
authUnlockAccountLinkSigningKey: authUnlockAccountLinkSigningKey,
378+
},
358379
)
359380
assert.Equal(t, want, unredactedSite)
360381
})
361382

362383
t.Run("unredacts secrets and respects edits to config", func(t *testing.T) {
363384
const newEmail = "new_email@example.com"
364385
input := getTestSiteWithSecrets(
365-
"new"+executorsAccessToken,
366-
redactedSecret, "new"+authGitLabClientSecret, redactedSecret,
367-
redactedSecret,
368-
redactedSecret,
369-
redactedSecret,
370-
redactedSecret,
371-
redactedSecret,
372-
redactedSecret,
373-
redactedSecret,
374-
redactedSecret,
386+
testSecrets{
387+
executorsAccessToken: "new" + executorsAccessToken,
388+
authOpenIDClientSecret: redactedSecret,
389+
authGitLabClientSecret: "new" + authGitLabClientSecret,
390+
authGitHubClientSecret: redactedSecret,
391+
authAzureDevOpsClientSecret: redactedSecret,
392+
emailSMTPPassword: redactedSecret,
393+
organizationInvitationsSigningKey: redactedSecret,
394+
githubClientSecret: redactedSecret,
395+
dotcomGitHubAppCloudClientSecret: redactedSecret,
396+
dotcomGitHubAppCloudPrivateKey: redactedSecret,
397+
dotcomSrcCliVersionCacheGitHubToken: redactedSecret,
398+
dotcomSrcCliVersionCacheGitHubWebhookSecret: redactedSecret,
399+
authUnlockAccountLinkSigningKey: redactedSecret,
400+
},
375401
newEmail,
376402
)
377403
unredactedSite, err := UnredactSecrets(input, conftypes.RawUnified{Site: previousSite})
378404
require.NoError(t, err)
379405

380406
// Expect new secrets and new email to show up in the unredacted version
381407
want := getTestSiteWithSecrets(
382-
"new"+executorsAccessToken,
383-
authOpenIDClientSecret, "new"+authGitLabClientSecret, authGitHubClientSecret,
384-
emailSMTPPassword,
385-
organizationInvitationsSigningKey,
386-
githubClientSecret,
387-
dotcomGitHubAppCloudClientSecret,
388-
dotcomGitHubAppCloudPrivateKey,
389-
dotcomSrcCliVersionCacheGitHubToken,
390-
dotcomSrcCliVersionCacheGitHubWebhookSecret,
391-
authUnlockAccountLinkSigningKey,
408+
testSecrets{
409+
executorsAccessToken: "new" + executorsAccessToken,
410+
authOpenIDClientSecret: authOpenIDClientSecret,
411+
authGitLabClientSecret: "new" + authGitLabClientSecret,
412+
authGitHubClientSecret: authGitHubClientSecret,
413+
authAzureDevOpsClientSecret: authAzureDevOpsClientSecret,
414+
emailSMTPPassword: emailSMTPPassword,
415+
organizationInvitationsSigningKey: organizationInvitationsSigningKey,
416+
githubClientSecret: githubClientSecret,
417+
dotcomGitHubAppCloudClientSecret: dotcomGitHubAppCloudClientSecret,
418+
dotcomGitHubAppCloudPrivateKey: dotcomGitHubAppCloudPrivateKey,
419+
dotcomSrcCliVersionCacheGitHubToken: dotcomSrcCliVersionCacheGitHubToken,
420+
dotcomSrcCliVersionCacheGitHubWebhookSecret: dotcomSrcCliVersionCacheGitHubWebhookSecret,
421+
authUnlockAccountLinkSigningKey: authUnlockAccountLinkSigningKey,
422+
},
392423
newEmail,
393424
)
394425
assert.Equal(t, want, unredactedSite)
395426
})
396427
}
397428

398429
func getTestSiteWithRedactedSecrets() string {
399-
return getTestSiteWithSecrets(redactedSecret, redactedSecret, redactedSecret, redactedSecret, redactedSecret, redactedSecret, redactedSecret, redactedSecret, redactedSecret, redactedSecret, redactedSecret, redactedSecret)
430+
return getTestSiteWithSecrets(
431+
testSecrets{
432+
executorsAccessToken: redactedSecret,
433+
authOpenIDClientSecret: redactedSecret,
434+
authGitLabClientSecret: redactedSecret,
435+
authGitHubClientSecret: redactedSecret,
436+
authAzureDevOpsClientSecret: redactedSecret,
437+
emailSMTPPassword: redactedSecret,
438+
organizationInvitationsSigningKey: redactedSecret,
439+
githubClientSecret: redactedSecret,
440+
dotcomGitHubAppCloudClientSecret: redactedSecret,
441+
dotcomGitHubAppCloudPrivateKey: redactedSecret,
442+
dotcomSrcCliVersionCacheGitHubToken: redactedSecret,
443+
dotcomSrcCliVersionCacheGitHubWebhookSecret: redactedSecret,
444+
authUnlockAccountLinkSigningKey: redactedSecret,
445+
},
446+
)
447+
}
448+
449+
type testSecrets struct {
450+
executorsAccessToken string
451+
authOpenIDClientSecret string
452+
authGitHubClientSecret string
453+
authGitLabClientSecret string
454+
authAzureDevOpsClientSecret string
455+
emailSMTPPassword string
456+
organizationInvitationsSigningKey string
457+
githubClientSecret string
458+
dotcomGitHubAppCloudClientSecret string
459+
dotcomGitHubAppCloudPrivateKey string
460+
dotcomSrcCliVersionCacheGitHubToken string
461+
dotcomSrcCliVersionCacheGitHubWebhookSecret string
462+
authUnlockAccountLinkSigningKey string
400463
}
401464

402-
func getTestSiteWithSecrets(
403-
executorsAccessToken,
404-
authOpenIDClientSecret, authGitHubClientSecret, authGitLabClientSecret,
405-
emailSMTPPassword,
406-
organizationInvitationsSigningKey,
407-
githubClientSecret,
408-
dotcomGitHubAppCloudClientSecret, dotcomGitHubAppCloudPrivateKey,
409-
dotcomSrcCliVersionCacheGitHubToken, dotcomSrcCliVersionCacheGitHubWebhookSecret,
410-
authUnlockAccountLinkSigningKey string,
411-
optionalEdit ...string,
412-
) string {
465+
func getTestSiteWithSecrets(testSecrets testSecrets, optionalEdit ...string) string {
413466
email := "noreply+dev@sourcegraph.com"
414467
if len(optionalEdit) > 0 {
415468
email = optionalEdit[0]
@@ -445,6 +498,13 @@ func getTestSiteWithSecrets(
445498
"displayName": "GitLab.com",
446499
"type": "gitlab",
447500
"url": "https://gitlab.com"
501+
},
502+
{
503+
"apiScope": "vso.code,vso.identity,vso.project,vso.work",
504+
"clientID": "sourcegraph-client-azuredevops",
505+
"clientSecret": "%s",
506+
"displayName": "Azure DevOps",
507+
"type": "azureDevOps"
448508
}
449509
],
450510
"observability.tracing": {
@@ -474,15 +534,20 @@ func getTestSiteWithSecrets(
474534
"auth.unlockAccountLinkSigningKey": "%s",
475535
}`,
476536
email,
477-
executorsAccessToken,
478-
authOpenIDClientSecret, authGitHubClientSecret, authGitLabClientSecret,
479-
emailSMTPPassword, // used again as username
480-
emailSMTPPassword,
481-
organizationInvitationsSigningKey,
482-
githubClientSecret,
483-
dotcomGitHubAppCloudClientSecret, dotcomGitHubAppCloudPrivateKey,
484-
dotcomSrcCliVersionCacheGitHubToken, dotcomSrcCliVersionCacheGitHubWebhookSecret,
485-
authUnlockAccountLinkSigningKey,
537+
testSecrets.executorsAccessToken,
538+
testSecrets.authOpenIDClientSecret,
539+
testSecrets.authGitHubClientSecret,
540+
testSecrets.authGitLabClientSecret,
541+
testSecrets.authAzureDevOpsClientSecret,
542+
testSecrets.emailSMTPPassword, // used again as username
543+
testSecrets.emailSMTPPassword,
544+
testSecrets.organizationInvitationsSigningKey,
545+
testSecrets.githubClientSecret,
546+
testSecrets.dotcomGitHubAppCloudClientSecret,
547+
testSecrets.dotcomGitHubAppCloudPrivateKey,
548+
testSecrets.dotcomSrcCliVersionCacheGitHubToken,
549+
testSecrets.dotcomSrcCliVersionCacheGitHubWebhookSecret,
550+
testSecrets.authUnlockAccountLinkSigningKey,
486551
)
487552

488553
}

0 commit comments

Comments
 (0)