Skip to content

[DPE-2838] Secret labels #270

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 5 commits into from
Nov 24, 2023
Merged

[DPE-2838] Secret labels #270

merged 5 commits into from
Nov 24, 2023

Conversation

dragomirp
Copy link
Contributor

@dragomirp dragomirp commented Nov 3, 2023 •
edited
Loading

github-advanced-security[bot]
github-advanced-security bot found potential problems Nov 3, 2023
View reviewed changes
src/charm.py
if scope not in [APP_SCOPE, UNIT_SCOPE]:
raise RuntimeError("Unknown secret scope.")
if not content.get(secret_key) or content[secret_key] == SECRET_DELETED_LABEL:
logger.error(f"Non-existing secret {scope}:{key} was attempted to be removed.")

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information

This expression logs [sensitive data (password)](1) as clear text. This expression logs [sensitive data (password)](2) as clear text. This expression logs [sensitive data (password)](3) as clear text. This expression logs [sensitive data (password)](4) as clear text. This expression logs [sensitive data (password)](5) as clear text. This expression logs [sensitive data (password)](6) as clear text. This expression logs [sensitive data (password)](7) as clear text. This expression logs [sensitive data (password)](8) as clear text.
src/charm.py
try:
self._peer_data(scope).pop(key)
except KeyError:
logger.error(f"Non-existing secret {scope}:{key} was attempted to be removed.")

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information

This expression logs [sensitive data (password)](1) as clear text. This expression logs [sensitive data (password)](2) as clear text. This expression logs [sensitive data (password)](3) as clear text. This expression logs [sensitive data (password)](4) as clear text. This expression logs [sensitive data (password)](5) as clear text. This expression logs [sensitive data (password)](6) as clear text. This expression logs [sensitive data (password)](7) as clear text. This expression logs [sensitive data (password)](8) as clear text.
@dragomirp dragomirp force-pushed the dpe-2838-secret-labels branch from 3cf8a80 to d33402f Compare November 3, 2023 16:11
@dragomirp dragomirp marked this pull request as ready for review November 24, 2023 10:34
juditnovak
juditnovak approved these changes Nov 24, 2023
View reviewed changes
Copy link
Contributor

@juditnovak juditnovak left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❤️ ❤️ ❤️

Thank U so much @dragomirp 4 this one!!!!!!!!!!!!!!!
(And all your help provided on mine :-) )

@dragomirp dragomirp merged commit 943e4bf into main Nov 24, 2023
@dragomirp dragomirp deleted the dpe-2838-secret-labels branch November 24, 2023 17:31
BON4 pushed a commit to BON4/postgresql-operator that referenced this pull request Apr 23, 2024
@dragomirp
[DPE-2838] Secret labels (canonical#270)
e4da21c 
* Secret labels

* Missing arg

* Pop the right databag

* Copy over safe secret get
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@delgod delgod delgod approved these changes

@marceloneppel marceloneppel Awaiting requested review from marceloneppel

@taurus-forever taurus-forever Awaiting requested review from taurus-forever

+1 more reviewer

@juditnovak juditnovak juditnovak approved these changes

Reviewers whose approvals may not affect merge requirements
Assignees
No one assigned
Labels
Libraries: Out of sync
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@dragomirp @delgod @juditnovak