novox/mesh-tools
18
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Runtime state guard: a name holding an object is data, not a credential, so a placement's binding of the provision secret is kept (issue 1126)

Browse Source
This commit is contained in:
jschoubben
2026-10-28 21:47:06 +01:00
parent 27266f99a3
commit 23f5babe33
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
node-tools/internal/bus/state.go
+5 -2
View File
@@ -391,7 +391,9 @@ func valueOf(raw []byte) json.RawMessage {
var credentialEndings = []string{"password", "passwd", "secret", "token", "credential", "credentials",
"authorization", "apikey", "privatekey", "accesskey", "cookie"}
// credentialField is the first field anywhere in a JSON value whose name says it is a credential, or "".
// credentialField is the first field anywhere in a JSON value whose name says it is a credential, or "". A credential is
// a value, so a name counts only where it holds one or a list of them: a name holding an object is data naming a structure (a
// placement's binding of the provision "secret" to the vault, issue 1126), whose own fields are looked at in turn.
func credentialField(value json.RawMessage) string {
var v any
if json.Unmarshal(value, &v) != nil {
@@ -408,8 +410,9 @@ func credentialField(value json.RawMessage) string {
sort.Strings(keys)
for _, k := range keys {
norm := strings.NewReplacer("-", "", "_", "", " ", "").Replace(strings.ToLower(k))
_, object := t[k].(map[string]any)
for _, end := range credentialEndings {
if strings.HasSuffix(norm, end) {
if strings.HasSuffix(norm, end) && !object {
return k
}
}