fix: remove cleartext password logging for security compliance#51
Merged
fix: remove cleartext password logging for security compliance#51
Conversation
Remove password from user creation output to comply with gosec security scan requirements. This fixes the cleartext logging warnings that were blocking the gosec v2.24.7 upgrade (PR #48). Changes: - Remove "Password: %s" from EMAIL template in user-create.go - Update fmt.Printf to omit password parameter - Add security note to output explaining password not displayed - Update integration test to not print sensitive data - Update documentation to reflect password is not output - Add nosec comment for legitimate OAuth2 token caching in client.go The password is still generated and set correctly, but is no longer displayed to stdout for security reasons. Users must change password on first login as enforced by ChangePasswordAtNextLogin flag. Security improvements: - Fixes gosec cleartext logging warning - Adds proper OAuth2 token caching exception - All security scans now pass (gosec 2.24.7: 0 issues)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes cleartext password logging from user creation output to comply with gosec v2.24.7 security requirements.
Problem
PR #48 (gosec upgrade to v2.24.7) is failing because the newer version detects cleartext password logging:
cmd/user-create.go:169fmt.Printf(EMAIL, user.PrimaryEmail, user.Password, user.PrimaryEmail)Additionally, gosec v2.24.7 introduced a new rule G117 that flags OAuth2 token serialization in
cmd/client.go:362.Solution
Password Logging Fix
fmt.Printfto omit password parameterOAuth2 Token Caching
#nosec G117comment for legitimate OAuth2 token cachingTesting
Results:
Security Improvements
Files Modified
cmd/user-create.go- Removed password from output template and callscmd/integration_test.go- Updated test to use non-sensitive datacmd/client.go- Added nosec comment for OAuth2 token cachingRelated
Next Steps
After this PR is merged, PR #48 should be rebased to pick up these security fixes, allowing the gosec upgrade to pass all checks.