Output can show OSS Index password in the plain
## Issue
Output currently obscures `nvd.api.key`, but not OSS Index credentials:
```
Merging additional properties:
nvd.api.key=31a0****-****-****-****-********5002
analyzer.ossindex.user=bob@dog.com
analyzer.ossindex.password=SomeVerySecretPassword
analyzer.ossindex.enabled=false
```
Relates to #133
## Option 1: Do nothing
Not great. Secrets shown.
## Option 2: Never show values
For example
```
Merging additional properties:
nvd.api.key
analyzer.ossindex.user
analyzer.ossindex.password
analyzer.ossindex.enabled=false
```
## Option 3: Occlude Sensitive Settings
This means we need to detect which setting might be sensitive.
Can we reliably do this?
```
Merging additional properties:
nvd.api.key=**OCCLUDED**
analyzer.ossindex.user=**OCCLUDED**
analyzer.ossindex.password=**OCCLUDED**
analyzer.ossindex.enabled=false
```
## Research
Let's take a peek at current interesting properties the REPL
```clojure
(require '[clojure.reflect :as reflect])
(->> org.owasp.dependencycheck.utils.Settings$KEYS
reflect/reflect
:members
(filter #(= #{:public :static :final} (:flags %)))
(mapv #(eval (symbol (str "org.owasp.dependencycheck.utils.Settings$KEYS/" (:name %)))))
(filter #(re-find #"(key|token|user|password|pw|secret)" %))
sort)
;; => ("analyzer.artifactory.api.token"
;; "analyzer.artifactory.api.username"
;; "analyzer.artifactory.bearer.token"
;; "analyzer.central.bearertoken"
;; "analyzer.central.password"
;; "analyzer.central.username"
;; "analyzer.nexus.password"
;; "analyzer.nexus.username"
;; "analyzer.ossindex.password"
;; "analyzer.ossindex.user"
;; "analyzer.retirejs.repo.js.bearertoken"
;; "analyzer.retirejs.repo.js.password"
;; "analyzer.retirejs.repo.js.username"
;; "central.content.bearertoken"
;; "central.content.password"
;; "central.content.username"
;; "data.password"
;; "data.user"
;; "hosted.suppressions.bearertoken"
;; "hosted.suppressions.password"
;; "hosted.suppressions.user"
;; "kev.bearertoken"
;; "kev.password"
;; "kev.user"
;; "nvd.api.datafeed.bearertoken"
;; "nvd.api.datafeed.password"
;; "nvd.api.datafeed.user"
;; "nvd.api.key"
;; "proxy.password"
;; "proxy.username"
;; "suppression.file.bearertoken"
;; "suppression.file.password"
;; "suppression.file.user")
```
Does dependency-check do anything in this area?
It does have an [`odc.settings-mask`](https://github.com/dependency-check/DependencyCheck/blob/9341f02c0d3272c78cd9fef9d48d955063502e50/core/src/main/resources/dependencycheck.properties#L29-L30):
```
# define which settings are masked when logged
odc.settings.mask=.*password.*,.*token.*,.*api.key.*
```
Which works [like so](https://github.com/dependency-check/DependencyCheck/blob/9341f02c0d3272c78cd9fef9d48d955063502e50/utils/src/test/java/org/owasp/dependencycheck/utils/SettingsTest.java#L324-L337):
```java
void testMaskedKeys() {
getSettings().initMaskedKeys();
assertThat("password should be masked",
getSettings().getPrintableValue("odc.database.password", "s3Cr3t!"),
equalTo("********"));
assertThat("tokens should be masked",
getSettings().getPrintableValue("odc.api.token", "asf4b$3428vasd84$#$45asda"),
equalTo("********"));
assertThat("other keys should not be masked",
getSettings().getPrintableValue("odc.version", "5.0.0"),
equalTo("5.0.0"));
}
```
By default, it doesn't mask `user` properties, but maybe it is good enough. It is certainly better than what we are currently doing.
## Proposal
I think option 3 is worth a try with the strategy of reusing dependency-check's mask support.
## Next Steps
I seem to be in clj-watson mode, so I'm happy to take a peek.
关闭于 2025-10-01 1 条评论