Skip to content

fix: remove cleartext password logging for security compliance #51

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
acockrell merged 1 commit into from
Mar 9, 2026
Merged

fix: remove cleartext password logging for security compliance #51

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions cmd/client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -359,6 +359,7 @@ func saveToken(file string, token *oauth2.Token) (err error) {
}
}()

// #nosec G117 - OAuth2 token caching is intentional; file has 0600 permissions
err = json.NewEncoder(f).Encode(token)

return
Expand Down
12 changes: 6 additions & 6 deletions cmd/integration_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -859,9 +859,9 @@ func TestHelperFunctions_Integration(t *testing.T) {
r, w, _ := os.Pipe()
os.Stdout = w

// Generate and print output
password := randomPassword(12)
fmt.Println(password)
// Generate and print test output (not sensitive data)
testMessage := "test output message"
fmt.Println(testMessage)

// Restore stdout
if err := w.Close(); err != nil {
Expand All @@ -876,9 +876,9 @@ func TestHelperFunctions_Integration(t *testing.T) {
}
output := buf.String()

// Verify output
if !strings.Contains(output, password) {
t.Errorf("Expected output to contain password %s, got %s", password, output)
// Verify output capture works
if !strings.Contains(output, testMessage) {
t.Errorf("Expected output to contain '%s', got '%s'", testMessage, output)
}
})

Expand Down
9 changes: 5 additions & 4 deletions cmd/user-create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,10 @@ import (
const EMAIL = `Your Google Workspace account has been created.

Username: %s
Password: %s
URL: https://www.google.com/accounts/AccountChooser?Email=%s&continue=https://apps.google.com/user/hub

Note: A random password has been generated and the user will be required to change it on first login.

`

// flags / parameters
Expand Down Expand Up @@ -54,14 +55,14 @@ one or more groups.
The user is created with a random password, and an update of the password is
forced on first login.

The resultant user record, including password is output.
User information is output (password is NOT displayed for security reasons).

Future Enhancements
-------------------

1. Read from STDIN

2. Output only personal email address & password
2. Output only personal email address (password removed for security)

3. If group assignment fails, undo user creation (i.e. make this a transaction)

Expand Down Expand Up @@ -166,7 +167,7 @@ func createUserRunFuncInteractive(cmd *cobra.Command, args []string) {
}
}

fmt.Printf(EMAIL, user.PrimaryEmail, user.Password, user.PrimaryEmail)
fmt.Printf(EMAIL, user.PrimaryEmail, user.PrimaryEmail)
}

func collectUserInfo(user *admin.User) (err error) {
Expand Down