{"action":"created","issue":{"url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/4","repository_url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror","labels_url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/4/comments","events_url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/4/events","html_url":"https://github.com/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/4","id":170868959,"number":4,"title":"Redact credentials from URLs in a cached-buildpack's output - Story Id: 127357631","user":{"login":"cf-trackermirror-bot","id":20690070,"avatar_url":"https://avatars.githubusercontent.com/u/20690070?v=3","gravatar_id":"","url":"https://api.github.com/users/cf-trackermirror-bot","html_url":"https://github.com/cf-trackermirror-bot","followers_url":"https://api.github.com/users/cf-trackermirror-bot/followers","following_url":"https://api.github.com/users/cf-trackermirror-bot/following{/other_user}","gists_url":"https://api.github.com/users/cf-trackermirror-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-trackermirror-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-trackermirror-bot/subscriptions","organizations_url":"https://api.github.com/users/cf-trackermirror-bot/orgs","repos_url":"https://api.github.com/users/cf-trackermirror-bot/repos","events_url":"https://api.github.com/users/cf-trackermirror-bot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-trackermirror-bot/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/labels/delivered","name":"delivered","color":"f08000"},{"url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/labels/feature","name":"feature","color":"ededed"},{"url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/labels/security","name":"security","color":"ededed"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":32,"created_at":"2016-08-12T13:17:07Z","updated_at":"2016-08-16T15:10:21Z","closed_at":null,"body":"If a buildpack creator / maintainer stores credentials in a url that point to a artifact required during application staging, there is a possibility that credentials can be leaked during staging to stdout.\n\nUse case: As an admin I have remote binaries on a file store somewhere that the cached buildpack needs to obtain without staging leaking the file store's credentials\n \nEx:\n\n```\n-------> Buildpack version 1.7.11\nfile:///tmp/buildpacks/6f818fc3725d9e1a746ce34ea2843e57/dependencies/*hidden mail*_concourse-binaries_godep_godep-v74-linux-x64.tgz\nfile:///tmp/buildpacks/6f818fc3725d9e1a746ce34ea2843e57/dependencies/*hidden mail*_concourse-binaries_glide_glide-v0.11.1-linux-x64.tgz\n```\n\nAC:\nGiven a manifest supplies a `login` and `password` in a url, the `stdout` in staging redacts ( with \"redacted\") the login and password strings\n\nGiven a manifest supplies an auth token, redact ( with \"redacted\") the token \n\ncached and uncached buildpacks are able to stage without fail\n\n---\n\nMirror: [story 127357631](https://www.pivotaltracker.com/story/show/127357631) submitted on Jul 29, 2016 UTC\n- **Requester**: Danny Rosen\n- **Owners**: James Wen, Jacques Chester\n- **Estimate**: 2.0"},"comment":{"url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/comments/240132622","html_url":"https://github.com/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/4#issuecomment-240132622","issue_url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/4","id":240132622,"user":{"login":"cf-trackermirror-bot","id":20690070,"avatar_url":"https://avatars.githubusercontent.com/u/20690070?v=3","gravatar_id":"","url":"https://api.github.com/users/cf-trackermirror-bot","html_url":"https://github.com/cf-trackermirror-bot","followers_url":"https://api.github.com/users/cf-trackermirror-bot/followers","following_url":"https://api.github.com/users/cf-trackermirror-bot/following{/other_user}","gists_url":"https://api.github.com/users/cf-trackermirror-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-trackermirror-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-trackermirror-bot/subscriptions","organizations_url":"https://api.github.com/users/cf-trackermirror-bot/orgs","repos_url":"https://api.github.com/users/cf-trackermirror-bot/repos","events_url":"https://api.github.com/users/cf-trackermirror-bot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-trackermirror-bot/received_events","type":"User","site_admin":false},"created_at":"2016-08-16T15:10:21Z","updated_at":"2016-08-16T15:10:21Z","body":"James Wen [commented](https://www.pivotaltracker.com/n/projects/1042066/stories/127357631/comments145687387) on Aug 3, 2016, 3.43 PM UTC:\n\nCommit by James Wen\nhttps://github.com/cloudfoundry/compile-extensions/commit/39f9df3e95950e82c884329b908e42c7eafeee76\n\nMake download_dependency script use URITranslator and filtered\ndependency paths in cached buildpack\n\n[#127357631]\n\nSigned-off-by: Sam Smith <*hidden mail*>\n\n<!--\nComment Id: 145687387\n-->"}}
{"actor":{"display_login":"cf-trackermirror-bot"}}