Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: password sanitization #117

Open
wants to merge 29 commits into
base: main
Choose a base branch
from
Open

feat: password sanitization #117

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
77bede9
feat: password sanitization
Ash-exp Dec 18, 2023
12d497c
updated docker login
Ash-exp Dec 19, 2023
3f7b9e8
fixed: format
Ash-exp Dec 19, 2023
7988261
fixed: updated gitcli
Ash-exp Dec 19, 2023
275e6c9
fixed: git cli issue
Ash-exp Dec 19, 2023
f298e8f
sanitised buildx commands
Ash-exp Dec 19, 2023
21f3cfa
added comments and fixed build pack cmds
Ash-exp Dec 20, 2023
4c7ca25
fixed: buildx k8s driver cmd
Ash-exp Dec 20, 2023
49472de
sanitized
Ash-exp Dec 22, 2023
eda3833
Merge branch 'main' into feat-password-sanitization
Ash-exp Jan 2, 2024
db9823f
fixed: docker push command
Ash-exp Jan 9, 2024
893b747
fixed: docker command
Ash-exp Jan 9, 2024
544476c
Refactored: cli commands
Ash-exp Jan 11, 2024
0e559e2
fixed: docker daemon command
Ash-exp Jan 11, 2024
c0da9c8
added empty arg check to cmd
Ash-exp Jan 11, 2024
384c372
fixed: docker stop command
Ash-exp Jan 11, 2024
efe62ed
added logs for debugging
Ash-exp Jan 11, 2024
c2fc9de
added: todo
Ash-exp Jan 11, 2024
2d753af
err log added
Ash-exp Jan 11, 2024
c69e8ea
added: log
Ash-exp Jan 11, 2024
5051979
fixed: docker daemon command
Ash-exp Jan 12, 2024
41c9945
reverted: docker daemon command
Ash-exp Jan 12, 2024
f62fa4a
debug: docker daemon command
Jan 12, 2024
e2d8c9b
removed: debug logs
Jan 12, 2024
8060139
debug: git merge logs
Jan 12, 2024
478119e
reverted: debug commits
Ash-exp Jan 12, 2024
4762af6
updated: LOCAL_BUILDX_LOCATION value
Ash-exp Jan 12, 2024
a15cb45
feat: updated checkAndCreateDirectory
Ash-exp Jan 12, 2024
fdff04f
feat: updated checkAndCreateDirectory
Ash-exp Jan 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions helper/DockerHelper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,7 @@ func DockerLogin(dockerCredentials *DockerCredentials) error {
pwd = pwd[:len(pwd)-1]
}
}
dockerLogin := fmt.Sprintf("docker login -u '%s' -p '%s' '%s' ", username, pwd, dockerCredentials.DockerRegistryURL)
dockerLogin := fmt.Sprintf("docker login -u %q -p %q %q", username, pwd, dockerCredentials.DockerRegistryURL)
awsLoginCmd := exec.Command("/bin/sh", "-c", dockerLogin)
err := util.RunCommand(awsLoginCmd)
if err != nil {
Expand Down Expand Up @@ -228,28 +228,28 @@ func BuildArtifact(ciRequest *CommonWorkflowRequest) (string, error) {
dockerBuild = dockerBuildxBuild + " "
}
if isTargetPlatformSet {
dockerBuild += "--platform " + dockerBuildConfig.TargetPlatform + " "
dockerBuild += fmt.Sprintf("--platform %q ", dockerBuildConfig.TargetPlatform)
}
}
dockerBuildFlags := make(map[string]string)
dockerBuildArgsMap := dockerBuildConfig.Args
for k, v := range dockerBuildArgsMap {
flagKey := fmt.Sprintf("%s %s", BUILD_ARG_FLAG, k)
flagKey := fmt.Sprintf("%s %q", BUILD_ARG_FLAG, strings.TrimSpace(k))
if strings.HasPrefix(v, DEVTRON_ENV_VAR_PREFIX) {
valueFromEnv := os.Getenv(strings.TrimPrefix(v, DEVTRON_ENV_VAR_PREFIX))
dockerBuildFlags[flagKey] = fmt.Sprintf("=\"%s\"", valueFromEnv)
dockerBuildFlags[flagKey] = fmt.Sprintf("=\"%s\"", strings.TrimSpace(valueFromEnv))
} else {
dockerBuildFlags[flagKey] = fmt.Sprintf("=%s", v)
dockerBuildFlags[flagKey] = fmt.Sprintf("=%s", strings.TrimSpace(v))
}
}
dockerBuildOptionsMap := dockerBuildConfig.DockerBuildOptions
for k, v := range dockerBuildOptionsMap {
flagKey := "--" + k
flagKey := "--" + strings.TrimSpace(k)
if strings.HasPrefix(v, DEVTRON_ENV_VAR_PREFIX) {
valueFromEnv := os.Getenv(strings.TrimPrefix(v, DEVTRON_ENV_VAR_PREFIX))
dockerBuildFlags[flagKey] = fmt.Sprintf("=%s", valueFromEnv)
dockerBuildFlags[flagKey] = fmt.Sprintf("=%s", strings.TrimSpace(valueFromEnv))
} else {
dockerBuildFlags[flagKey] = fmt.Sprintf("=%s", v)
dockerBuildFlags[flagKey] = fmt.Sprintf("=%s", strings.TrimSpace(v))
}
}
for key, value := range dockerBuildFlags {
Expand Down Expand Up @@ -295,7 +295,7 @@ func BuildArtifact(ciRequest *CommonWorkflowRequest) (string, error) {

dockerBuild = getBuildxBuildCommand(cacheEnabled, dockerBuild, oldCacheBuildxPath, localCachePath, dest, dockerBuildConfig)
} else {
dockerBuild = fmt.Sprintf("%s -f %s --network host -t %s %s", dockerBuild, dockerBuildConfig.DockerfilePath, ciRequest.DockerRepository, dockerBuildConfig.BuildContext)
dockerBuild = fmt.Sprintf("%s -f %q --network host -t %q %s", dockerBuild, dockerBuildConfig.DockerfilePath, ciRequest.DockerRepository, dockerBuildConfig.BuildContext)
}
if envVars.ShowDockerBuildCmdInLogs {
log.Println("Starting docker build : ", dockerBuild)
Expand Down Expand Up @@ -355,9 +355,9 @@ func BuildArtifact(ciRequest *CommonWorkflowRequest) (string, error) {
}

func getBuildxBuildCommand(cacheEnabled bool, dockerBuild, oldCacheBuildxPath, localCachePath, dest string, dockerBuildConfig *DockerBuildConfig) string {
dockerBuild = fmt.Sprintf("%s -f %s -t %s --push %s --network host --allow network.host --allow security.insecure", dockerBuild, dockerBuildConfig.DockerfilePath, dest, dockerBuildConfig.BuildContext)
dockerBuild = fmt.Sprintf("%s -f %q -t %q --push %q --network host --allow network.host --allow security.insecure", dockerBuild, dockerBuildConfig.DockerfilePath, dest, dockerBuildConfig.BuildContext)
if cacheEnabled {
dockerBuild = fmt.Sprintf("%s --cache-to=type=local,dest=%s,mode=max --cache-from=type=local,src=%s", dockerBuild, localCachePath, oldCacheBuildxPath)
dockerBuild = fmt.Sprintf("%s --cache-to=type=local,dest=%q,mode=max --cache-from=type=local,src=%s", dockerBuild, localCachePath, oldCacheBuildxPath)
}

provenanceFlag := dockerBuildConfig.GetProvenanceFlag()
Expand Down Expand Up @@ -455,7 +455,7 @@ func executeCmd(dockerBuild string) error {
}

func tagDockerBuild(dockerRepository string, dest string) error {
dockerTag := "docker tag " + dockerRepository + ":latest" + " " + dest
dockerTag := fmt.Sprintf("docker tag %q:latest %q", dockerRepository, dest)
Ash-exp marked this conversation as resolved.
Show resolved Hide resolved
log.Println(" -----> " + dockerTag)
dockerTagCMD := exec.Command("/bin/sh", "-c", dockerTag)
err := util.RunCommand(dockerTagCMD)
Expand Down Expand Up @@ -547,7 +547,7 @@ func BuildDockerImagePath(ciRequest *CommonWorkflowRequest) (string, error) {

func PushArtifact(dest string) error {
//awsLogin := "$(aws ecr get-login --no-include-email --region " + ciRequest.AwsRegion + ")"
dockerPush := "docker push " + dest
dockerPush := fmt.Sprintf("docker push %q", dest)
log.Println("-----> " + dockerPush)
dockerPushCMD := exec.Command("/bin/sh", "-c", dockerPush)
err := util.RunCommand(dockerPushCMD)
Expand Down Expand Up @@ -581,7 +581,7 @@ func ExtractDigestForBuildx(dest string) (string, error) {
}

func ExtractDigestUsingPull(dest string) (string, error) {
dockerPull := "docker pull " + dest
dockerPull := fmt.Sprintf("docker pull %q", dest)
dockerPullCmd := exec.Command("/bin/sh", "-c", dockerPull)
digest, err := runGetDockerImageDigest(dockerPullCmd)
if err != nil {
Expand Down
6 changes: 3 additions & 3 deletions helper/GitCliHelper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,8 +39,8 @@ func (impl *GitUtil) Checkout(rootDir string, checkout string) (response, errMsg
func (impl *GitUtil) runCommandWithCred(cmd *exec.Cmd, userName, password string) (response, errMsg string, err error) {
cmd.Env = append(os.Environ(),
fmt.Sprintf("GIT_ASKPASS=%s", GIT_AKS_PASS),
fmt.Sprintf("GIT_USERNAME=%s", userName), // ignored
fmt.Sprintf("GIT_PASSWORD=%s", password), // this value is used
fmt.Sprintf("GIT_USERNAME=%q", userName), // ignored; %q is used intentionally to sanitise the username
fmt.Sprintf("GIT_PASSWORD=%q", password), // this value is used; %q is used intentionally to sanitise the password
)
return impl.runCommand(cmd)
}
Expand Down Expand Up @@ -102,7 +102,7 @@ func (impl *GitUtil) Clone(gitContext GitContext, rootDir string, remoteUrl stri
// setting user.name and user.email as for non-fast-forward merge, git ask for user.name and email
func (impl *GitUtil) Merge(rootDir string, commit string) (response, errMsg string, err error) {
log.Println(util.DEVTRON, "git merge ", "location", rootDir)
command := "cd " + rootDir + " && git config user.email git@devtron.com && git config user.name Devtron && git merge " + commit + " --no-commit"
command := fmt.Sprintf("cd %q && git config user.email git@devtron.com && git config user.name Devtron && git merge %q --no-commit", rootDir, commit)
cmd := exec.Command("/bin/sh", "-c", command)
output, errMsg, err := impl.runCommand(cmd)
log.Println(util.DEVTRON, "merge output", "root", rootDir, "opt", output, "errMsg", errMsg, "error", err)
Expand Down