Implement secrets concealer in build logs

agent/agent.go

@@ -33,6 +33,7 @@ type Agent struct {
 	Netrc          []string
 	Local          string
 	Pull           bool
+	ConcealSecrets bool
 }
 
 func (a *Agent) Poll() error {
@@ -188,6 +189,7 @@ func (a *Agent) exec(spec *yaml.Config, payload *model.Work, cancel <-chan bool)
 		return err
 	}
 
+	secretsReplacer := newSecretsReplacer(payload.Secrets)
 	timeout := time.After(time.Duration(payload.Repo.Timeout) * time.Minute)
 
 	for {
@@ -227,11 +229,25 @@ func (a *Agent) exec(spec *yaml.Config, payload *model.Work, cancel <-chan bool)
 				pipeline.Exec()
 			}
 		case line := <-pipeline.Pipe():
+			// FIXME(vaijab): avoid checking a.ConcealSecrets is true everytime new line is received
+			if a.ConcealSecrets {
+				line.Out = secretsReplacer.Replace(line.Out)
+			}
 			a.Logger(line)
 		}
 	}
 }
 
+// newSecretsReplacer takes []*model.Secret as secrets and returns a list of
+// secret value, "*****" pairs.
+func newSecretsReplacer(secrets []*model.Secret) *strings.Replacer {
+	var r []string
+	for _, s := range secrets {
+		r = append(r, s.Value, "*****")
+	}
+	return strings.NewReplacer(r...)
+}
+
 func toEnv(w *model.Work) map[string]string {
 	envs := map[string]string{
 		"CI":                         "drone",

agent/agent_test.go

@@ -0,0 +1,23 @@
+package agent
+
+import "testing"
+import "github.com/drone/drone/model"
+
+func Test_newSecretsReplacer(t *testing.T) {
+	secrets := []*model.Secret{
+		{Name: "SECRET",
+			Value:  "secret_value",
+			Images: []string{"*"},
+			Events: []string{"*"},
+		},
+	}
+
+	text := "This is SECRET: secret_value"
+	expected := "This is SECRET: *****"
+	secretsReplacer := newSecretsReplacer(secrets)
+	result := secretsReplacer.Replace(text)
+
+	if result != expected {
+		t.Errorf("Wanted %q, got %q.", expected, result)
+	}
+}

drone/agent/agent.go

@@ -75,6 +75,11 @@ var AgentCmd = cli.Command{
 			Name:   "drone-secret",
 			Usage:  "drone agent secret",
 		},
+		cli.BoolFlag{
+			Name:   "conceal-secrets",
+			Usage:  "conceal secrets from build logs",
+			EnvVar: "DRONE_CONCEAL_SECRETS",
+		},
 		cli.DurationFlag{
 			EnvVar: "DRONE_BACKOFF",
 			Name:   "backoff",
@@ -192,6 +197,7 @@ func start(c *cli.Context) {
 				privileged:     c.StringSlice("privileged"),
 				pull:           c.BoolT("pull"),
 				logs:           int64(c.Int("max-log-size")) * 1000000,
+				concealSecrets: c.Bool("conceal-secrets"),
 			},
 		}
 

drone/agent/exec.go

@@ -19,6 +19,7 @@ type config struct {
 	pull           bool
 	logs           int64
 	timeout        time.Duration
+	concealSecrets bool
 }
 
 type pipeline struct {
@@ -48,6 +49,7 @@ func (r *pipeline) run(w *model.Work) {
 		Namespace:      r.config.namespace,
 		Escalate:       r.config.privileged,
 		Pull:           r.config.pull,
+		ConcealSecrets: r.config.concealSecrets,
 	}
 
 	cancelFunc := func(m *stomp.Message) {

drone/exec.go

@@ -48,6 +48,11 @@ var execCmd = cli.Command{
 			Usage:  "build secrets file in KEY=VALUE format",
 			EnvVar: "DRONE_SECRETS_FILE",
 		},
+		cli.BoolFlag{
+			Name:   "conceal-secrets",
+			Usage:  "conceal secrets from build logs",
+			EnvVar: "DRONE_CONCEAL_SECRETS",
+		},
 		cli.StringSliceFlag{
 			Name:   "matrix",
 			Usage:  "build matrix in KEY=VALUE format",
@@ -337,6 +342,7 @@ func exec(c *cli.Context) error {
 		Netrc:          []string{},
 		Local:          dir,
 		Pull:           c.Bool("pull"),
+		ConcealSecrets: c.Bool("conceal-secrets"),
 	}
 
 	payload := &model.Work{