gian/incus-mirror
1
0
Fork 0
mirror of https://github.com/lxc/incus synced 2026-08-02 05:26:46 +00:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

shared/api: Hide additional sensitive config keys

Browse Source 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
This commit is contained in:
Stéphane Graber 2026-07-31 17:26:07 -04:00
parent cb4ef49b8b
commit 1926918563
No known key found for this signature in database
GPG Key ID: C638974D64792D67
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
shared/api/server.go
View File

@ -1,6 +1,7 @@
package api
import (
"slices"
"strings"
"go.yaml.in/yaml/v4"
@ -228,10 +229,15 @@ func (srv *Server) Writable() ServerPut {
// isConfigKeySensitive is used to check if a given configuration key is likely to be sensitive and should be censored.
func isConfigKeySensitive(key string) bool {
// Sensitive keys that aren't covered by the suffix check.
if slices.Contains([]string{"acme.eab.kid", "acme.provider.environment", "oidc.client.id"}, key) {
return true
}
fields := strings.Split(key, ".")
segment := fields[len(fields)-1]
for _, suffix := range []string{"key", "cert", "password", "secret", "token"} {
for _, suffix := range []string{"key", "cert", "hmac", "password", "secret", "token"} {
if strings.HasSuffix(segment, suffix) {
return true
}