From a0964775abf35429f3e1e23c93d3a548dc2def4a Mon Sep 17 00:00:00 2001
From: Ethan Koenig <ethantkoenig@gmail.com>
Date: Sat, 2 Dec 2017 21:29:41 -0800
Subject: [PATCH] Sanitize logs for mirror sync (#3057)
---
models/repo.go | 7 ++++++-
models/repo_mirror.go | 47 ++++++++++++++++++++++++++++++++++++-------
2 files changed, 46 insertions(+), 8 deletions(-)
diff --git a/models/repo.go b/models/repo.go
index a9f0d93031..3142b324f1 100644
--- a/models/repo.go
+++ b/models/repo.go
@@ -605,9 +605,14 @@ func (repo *Repository) RepoPath() string {
return repo.repoPath(x)
}
+// GitConfigPath returns the path to a repository's git config/ directory
+func GitConfigPath(repoPath string) string {
+ return filepath.Join(repoPath, "config")
+}
+
// GitConfigPath returns the repository git config path
func (repo *Repository) GitConfigPath() string {
- return filepath.Join(repo.RepoPath(), "config")
+ return GitConfigPath(repo.RepoPath())
}
// RelLink returns the repository relative link
diff --git a/models/repo_mirror.go b/models/repo_mirror.go
index 77cd98faa8..92e8788fb5 100644
--- a/models/repo_mirror.go
+++ b/models/repo_mirror.go
@@ -76,17 +76,23 @@ func (m *Mirror) ScheduleNextUpdate() {
m.NextUpdate = time.Now().Add(m.Interval)
}
+func remoteAddress(repoPath string) (string, error) {
+ cfg, err := ini.Load(GitConfigPath(repoPath))
+ if err != nil {
+ return "", err
+ }
+ return cfg.Section("remote \"origin\"").Key("url").Value(), nil
+}
+
func (m *Mirror) readAddress() {
if len(m.address) > 0 {
return
}
-
- cfg, err := ini.Load(m.Repo.GitConfigPath())
+ var err error
+ m.address, err = remoteAddress(m.Repo.RepoPath())
if err != nil {
- log.Error(4, "Load: %v", err)
- return
+ log.Error(4, "remoteAddress: %v", err)
}
- m.address = cfg.Section("remote \"origin\"").Key("url").Value()
}
// HandleCloneUserCredentials replaces user credentials from HTTP/HTTPS URL
@@ -107,6 +113,19 @@ func HandleCloneUserCredentials(url string, mosaics bool) string {
return url[:start+3] + url[i+1:]
}
+// sanitizeOutput sanitizes output of a command, replacing occurrences of the
+// repository's remote address with a sanitized version.
+func sanitizeOutput(output, repoPath string) (string, error) {
+ remoteAddr, err := remoteAddress(repoPath)
+ if err != nil {
+ // if we're unable to load the remote address, then we're unable to
+ // sanitize.
+ return "", err
+ }
+ sanitized := HandleCloneUserCredentials(remoteAddr, true)
+ return strings.Replace(output, remoteAddr, sanitized, -1), nil
+}
+
// Address returns mirror address from Git repository config without credentials.
func (m *Mirror) Address() string {
m.readAddress()
@@ -145,7 +164,14 @@ func (m *Mirror) runSync() bool {
if _, stderr, err := process.GetManager().ExecDir(
timeout, repoPath, fmt.Sprintf("Mirror.runSync: %s", repoPath),
"git", gitArgs...); err != nil {
- desc := fmt.Sprintf("Failed to update mirror repository '%s': %s", repoPath, stderr)
+ // sanitize the output, since it may contain the remote address, which may
+ // contain a password
+ message, err := sanitizeOutput(stderr, repoPath)
+ if err != nil {
+ log.Error(4, "sanitizeOutput: %v", err)
+ return false
+ }
+ desc := fmt.Sprintf("Failed to update mirror repository '%s': %s", repoPath, message)
log.Error(4, desc)
if err = CreateRepositoryNotice(desc); err != nil {
log.Error(4, "CreateRepositoryNotice: %v", err)
@@ -170,7 +196,14 @@ func (m *Mirror) runSync() bool {
if _, stderr, err := process.GetManager().ExecDir(
timeout, wikiPath, fmt.Sprintf("Mirror.runSync: %s", wikiPath),
"git", "remote", "update", "--prune"); err != nil {
- desc := fmt.Sprintf("Failed to update mirror wiki repository '%s': %s", wikiPath, stderr)
+ // sanitize the output, since it may contain the remote address, which may
+ // contain a password
+ message, err := sanitizeOutput(stderr, wikiPath)
+ if err != nil {
+ log.Error(4, "sanitizeOutput: %v", err)
+ return false
+ }
+ desc := fmt.Sprintf("Failed to update mirror wiki repository '%s': %s", wikiPath, message)
log.Error(4, desc)
if err = CreateRepositoryNotice(desc); err != nil {
log.Error(4, "CreateRepositoryNotice: %v", err)