Skip to content

Commit

Permalink
Document Resource options that potentially leak secrets (#2727)
Browse files Browse the repository at this point in the history
The WithProcess and WithProcessCommandArgs options contain command line
arguments as resource attributes. These could potentially expose user
secrets. Document this fact so users better understand the implications
of using these options.
  • Loading branch information
MrAlias authored Mar 28, 2022
1 parent 7a1ebf7 commit 0a7cf5a
Showing 1 changed file with 15 additions and 2 deletions.
17 changes: 15 additions & 2 deletions sdk/resource/config.go
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,16 @@ func WithOSDescription() Option {
}

// WithProcess adds all the Process attributes to the configured Resource.
// See individual WithProcess* functions to configure specific attributes.
//
// Warning! This option will include process command line arguments. If these
// contain sensitive information it will be included in the exported resource.
//
// This option is equivalent to calling WithProcessPID,
// WithProcessExecutableName, WithProcessExecutablePath,
// WithProcessCommandArgs, WithProcessOwner, WithProcessRuntimeName,
// WithProcessRuntimeVersion, and WithProcessRuntimeDescription. See each
// option function for information about what resource attributes each
// includes.
func WithProcess() Option {
return WithDetectors(
processPIDDetector{},
Expand Down Expand Up @@ -143,7 +152,11 @@ func WithProcessExecutablePath() Option {
}

// WithProcessCommandArgs adds an attribute with all the command arguments (including
// the command/executable itself) as received by the process the configured Resource.
// the command/executable itself) as received by the process to the configured
// Resource.
//
// Warning! This option will include process command line arguments. If these
// contain sensitive information it will be included in the exported resource.
func WithProcessCommandArgs() Option {
return WithDetectors(processCommandArgsDetector{})
}
Expand Down

0 comments on commit 0a7cf5a

Please sign in to comment.