ansible-collections/community.general
1
0
Fork 0
mirror of https://github.com/ansible-collections/community.general.git synced 2025-07-27 07:01:22 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

use regex vs list to weed out password fields

Browse source 
- also warn as module SHOULD have no_log
 - make password regex exportable for testing
 - avoids boolean fields
This commit is contained in:
Brian Coca 2017-02-09 13:59:29 -05:00 • committed by Brian Coca
commit 403e9d35df
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/ansible/module_utils/basic.py
View file

@ -167,6 +167,8 @@ from ansible.module_utils.six import (PY2, PY3, b, binary_type, integer_types,
from ansible.module_utils.six.moves import map, reduce from ansible.module_utils.six.moves import map, reduce
from ansible.module_utils._text import to_native, to_bytes, to_text from ansible.module_utils._text import to_native, to_bytes, to_text
PASSWORD_MATCH = re.compile(r'^(?:.+[-_\s])?pass(?:[-_\s]?(?:word|phrase|wrd|wd)?)(?:[-_\s].+)?$', re.I)
_NUMBERTYPES = tuple(list(integer_types) + [float]) _NUMBERTYPES = tuple(list(integer_types) + [float])
# Deprecated compat. Only kept in case another module used these names Using # Deprecated compat. Only kept in case another module used these names Using
@ -1808,17 +1810,19 @@ class AnsibleModule(object):
# TODO: generalize a separate log function and make log_invocation use it # TODO: generalize a separate log function and make log_invocation use it
# Sanitize possible password argument when logging. # Sanitize possible password argument when logging.
log_args = dict() log_args = dict()
passwd_keys = ['password', 'login_password', 'url_password']
for param in self.params: for param in self.params:
canon = self.aliases.get(param, param) canon = self.aliases.get(param, param)
arg_opts = self.argument_spec.get(canon, {}) arg_opts = self.argument_spec.get(canon, {})
no_log = arg_opts.get('no_log', False) no_log = arg_opts.get('no_log', False)
arg_type = arg_opts.get('type', 'str')
if self.boolean(no_log): if self.boolean(no_log):
log_args[param] = 'NOT_LOGGING_PARAMETER' log_args[param] = 'NOT_LOGGING_PARAMETER'
elif param in passwd_keys: # try to capture all passwords/passphrase named fields
elif arg_type != 'bool' and PASSWORD_MATCH.search(param):
log_args[param] = 'NOT_LOGGING_PASSWORD' log_args[param] = 'NOT_LOGGING_PASSWORD'
self.warn('Module did not set no_log for %s' % param)
else: else:
param_val = self.params[param] param_val = self.params[param]
if not isinstance(param_val, (text_type, binary_type)): if not isinstance(param_val, (text_type, binary_type)):