Backport #5382 to 1.1.latest

.changes/unreleased/Under the Hood-20220616-120516.yaml

@@ -0,0 +1,7 @@
+kind: Under the Hood
+body: 'Add annotation to render_value method reimplemented in #5334'
+time: 2022-06-16T12:05:16.474078+02:00
+custom:
+ Author: jtcohen6
+ Issue: "4796"
+ PR: "5382"

.changie.yaml

@@ -14,6 +14,7 @@ kinds:
 - label: Docs
 - label: Under the Hood
 - label: Dependencies
+- label: Security
 custom:
 - key: Author
  label: GitHub Username(s) (separated by a single space if multiple)

core/dbt/config/renderer.py

@@ -178,7 +178,12 @@ def name(self):
  return "Secret"
 
  def render_value(self, value: Any, keypath: Optional[Keypath] = None) -> Any:
+ # First, standard Jinja rendering, with special handling for 'secret' environment variables
+ # "{{ env_var('DBT_SECRET_ENV_VAR') }}" -> "$$$DBT_SECRET_START$$$DBT_SECRET_ENV_{VARIABLE_NAME}$$$DBT_SECRET_END$$$"
+ # This prevents Jinja manipulation of secrets via macros/filters that might leak partial/modified values in logs
  rendered = super().render_value(value, keypath)
+ # Now, detect instances of the placeholder value ($$$DBT_SECRET_START...DBT_SECRET_END$$$)
+ # and replace them with the actual secret value
  if SECRET_ENV_PREFIX in str(rendered):
  search_group = f"({SECRET_ENV_PREFIX}(.*))"
  pattern = SECRET_PLACEHOLDER.format(search_group).replace("$", r"\$")

test/integration/013_context_var_tests/test_context_vars.py

@@ -251,6 +251,29 @@ def test_postgres_fail_clone_with_scrubbing(self):
  assert "abc123" not in str(exc.exception)
 
 
+class TestCloneFailSecretNotRendered(TestCloneFailSecretScrubbed):
+
+ @property
+ def packages_config(self):
+ return {
+ "packages": [
+ {
+ "git": "https://fakeuser:{{ env_var('DBT_ENV_SECRET_GIT_TOKEN') | join(' ') }}@github.com/dbt-labs/fake-repo.git"
+ },
+ ]
+ }
+
+ @use_profile('postgres')
+ def test_postgres_fail_clone_with_scrubbing(self):
+ with self.assertRaises(dbt.exceptions.InternalException) as exc:
+ _, log_output = self.run_dbt_and_capture(["deps"])
+
+ # we should not see any manipulated form of the secret value (abc123) here
+ # we should see a manipulated form of the placeholder instead
+ assert "a b c 1 2 3" not in str(exc.exception)
+ assert "D B T _ E N V _ S E C R E T _ G I T _ T O K E N" in str(exc.exception)
+
+
 class TestEmitWarning(DBTIntegrationTest):
  @property
  def schema(self):