You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

64 lines
1.9 KiB

From 2fce9e3eefd9dda6d74660ebe49f731f8b11111a Mon Sep 17 00:00:00 2001
From: Jan Chaloupka <jchaloup@redhat.com>
Date: Thu, 2 Jan 2020 12:29:57 +0100
Subject: [PATCH] Hide bearer token in logs: upstream #81330
---
.../k8s.io/client-go/transport/round_trippers.go | 33 ++++++++++++++++++++++
1 file changed, 33 insertions(+)
diff --git a/src/k8s.io/kubernetes/staging/src/k8s.io/client-go/transport/round_trippers.go b/src/k8s.io/kubernetes/staging/src/k8s.io/client-go/transport/round_trippers.go
index 117a9c8..844ee9a 100644
--- a/src/k8s.io/kubernetes/staging/src/k8s.io/client-go/transport/round_trippers.go
+++ b/src/k8s.io/kubernetes/staging/src/k8s.io/client-go/transport/round_trippers.go
@@ -409,6 +409,38 @@ func (rt *debuggingRoundTripper) CancelRequest(req *http.Request) {
}
}
+var knownAuthTypes = map[string]bool{
+ "bearer": true,
+ "basic": true,
+ "negotiate": true,
+}
+
+// maskValue masks credential content from authorization headers
+// See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization
+func maskValue(key string, value string) string {
+ if !strings.EqualFold(key, "Authorization") {
+ return value
+ }
+ if len(value) == 0 {
+ return ""
+ }
+ var authType string
+ if i := strings.Index(value, " "); i > 0 {
+ authType = value[0:i]
+ } else {
+ authType = value
+ }
+ if !knownAuthTypes[strings.ToLower(authType)] {
+ return "<masked>"
+ }
+ if len(value) > len(authType)+1 {
+ value = authType + " <masked>"
+ } else {
+ value = authType
+ }
+ return value
+}
+
func (rt *debuggingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
reqInfo := newRequestInfo(req)
@@ -423,6 +455,7 @@ func (rt *debuggingRoundTripper) RoundTrip(req *http.Request) (*http.Response, e
klog.Infof("Request Headers:")
for key, values := range reqInfo.RequestHeaders {
for _, value := range values {
+ value = maskValue(key, value)
klog.Infof(" %s: %s", key, value)
}
}
--
2.7.5