{"action":"created","issue":{"url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/1","repository_url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror","labels_url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/1/comments","events_url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/1/events","html_url":"https://github.com/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/1","id":170868292,"number":1,"title":"Redact credentials from URLs in a uncached-buildpack's output - Story Id: 126514693","user":{"login":"cf-trackermirror-bot","id":20690070,"avatar_url":"https://avatars.githubusercontent.com/u/20690070?v=3","gravatar_id":"","url":"https://api.github.com/users/cf-trackermirror-bot","html_url":"https://github.com/cf-trackermirror-bot","followers_url":"https://api.github.com/users/cf-trackermirror-bot/followers","following_url":"https://api.github.com/users/cf-trackermirror-bot/following{/other_user}","gists_url":"https://api.github.com/users/cf-trackermirror-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-trackermirror-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-trackermirror-bot/subscriptions","organizations_url":"https://api.github.com/users/cf-trackermirror-bot/orgs","repos_url":"https://api.github.com/users/cf-trackermirror-bot/repos","events_url":"https://api.github.com/users/cf-trackermirror-bot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-trackermirror-bot/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/labels/delivered","name":"delivered","color":"f08000"},{"url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/labels/feature","name":"feature","color":"ededed"},{"url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/labels/security","name":"security","color":"ededed"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":38,"created_at":"2016-08-12T13:13:10Z","updated_at":"2016-08-12T13:14:37Z","closed_at":null,"body":"If a buildpack creator / maintainer stores credentials in a url that point to a artifact required during application staging, there is a possibility that credentials can be leaked during staging to stdout.\n\nUse case: As an admin I have remote binaries on a file store somewhere that the uncached buildpack needs to obtain without staging leaking the file store's credentials\n \nEx:\n\n```\n-------> Buildpack version 4.3.10\nInstalling HTTPD\nDownloaded [https://login:*hidden mail*/buildpack_binaries/httpd/httpd-2.4.20-linux-x64.tgz] to [/tmp]\n```\n\n\n\nAC:\nGiven a manifest supplies a `login` and `password` in a url, the `stdout` in staging redacts ( with \"redacted\") the login and password strings\n\nGiven a manifest supplies an auth token, redact ( with \"redacted\") the token \n\ncached uncached buildpacks are able to stage without fail\n\n---\n\nMirror: [story 126514693](https://www.pivotaltracker.com/story/show/126514693) submitted on Jul 18, 2016 UTC\n- **Requester**: Danny Rosen\n- **Owners**: Gabriel Ramirez, Sam Smith\n- **Estimate**: 2.0"},"comment":{"url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/comments/239442676","html_url":"https://github.com/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/1#issuecomment-239442676","issue_url":"https://api.github.com/repos/cf-trackermirror-bot/buildpacks-tracker-mirror/issues/1","id":239442676,"user":{"login":"cf-trackermirror-bot","id":20690070,"avatar_url":"https://avatars.githubusercontent.com/u/20690070?v=3","gravatar_id":"","url":"https://api.github.com/users/cf-trackermirror-bot","html_url":"https://github.com/cf-trackermirror-bot","followers_url":"https://api.github.com/users/cf-trackermirror-bot/followers","following_url":"https://api.github.com/users/cf-trackermirror-bot/following{/other_user}","gists_url":"https://api.github.com/users/cf-trackermirror-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-trackermirror-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-trackermirror-bot/subscriptions","organizations_url":"https://api.github.com/users/cf-trackermirror-bot/orgs","repos_url":"https://api.github.com/users/cf-trackermirror-bot/repos","events_url":"https://api.github.com/users/cf-trackermirror-bot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-trackermirror-bot/received_events","type":"User","site_admin":false},"created_at":"2016-08-12T13:14:37Z","updated_at":"2016-08-12T13:14:37Z","body":"Jacques Chester [commented](https://www.pivotaltracker.com/n/projects/1042066/stories/126514693/comments145292009) on Jul 29, 2016, 2.40 PM UTC:\n\nWe've realised that changing buildpack-packager is an unavoidable necessity based on the A/C (meaning #127110133 would be redundant).\n\nCached buildpacks show the \"downloading\" message and give the file name. Right now, that will include the username and password in the underscore-ified format that buildpack-packager creates.\n\nEg:\n\n```\nDownloaded [file:///tmp/buildpacks/f884f12a2292a8919ef4faf07d212635/dependencies/*hidden mail*_concourse-binaries_nginx_nginx-1.11.3-linux-x64.tgz] to [/tmp]\n```\n\nThe problem is that while this is a valid URI, the login and password components are no longer recognised as such by URI, because we changed `:` to `_`. So we would have to do whacky and unreliable regexes.\n\nIt will be better if, instead, the redaction is done by buildpack-packager. This way compile-extensions does not need to have two codepaths, one reliable, another one less reliable.\n\nIt's worth noting that there is no way to avoid having credentials in the manifest.yml at build or run time. There needs to be a source URI for either codebase to transform.\n\n<!--\nComment Id: 145292009\n-->"}}
{"actor":{"display_login":"cf-trackermirror-bot"}}