Repository navigation
fix: prevent sensitive data exposure in KMS error logs - #1217
Conversation
Log only the operation and gRPC status code on encryption and decryption failures. Add regression coverage for request payloads and secret-bearing backend errors. ai-assisted=yes TNZGOV-447
cf-foundation-community-automation
Bot
moved this to Inbox
in Foundational Infrastructure Working Group
| LOGGER.error("Error for request: " + request.getPlain(), e); | ||
| // KMS error descriptions and causes can also contain credential data. | ||
| LOGGER.error("KMS encryption failed with status {}", e.getStatus().getCode()); | ||
| throw e; |
There was a problem hiding this comment.
The credential data is most likely still in this exception that is getting thrown back to callers. Can you confirm how the callers handle / log these exceptions?
There was a problem hiding this comment.
Thanks for pointing that out.
Analyzed the call stacks with Codex. The exception ends up in DefaultExceptionHandler (components/errors/src/main/kotlin/org/cloudfoundry/credhub/generate/DefaultExceptionHandler.kt:18), which logs the complete exception, including causes. If the KMS includes a secret in its error description, that secret can reach application logs.
Made new commit to address that.
| } | ||
| LOGGER.error("Error for request: " + request.getCipher(), e); | ||
| LOGGER.error("KMS decryption failed with status {}", e.getStatus().getCode()); | ||
| throw e; |
There was a problem hiding this comment.
Addressed in the new commit.
Preserve gRPC status codes while removing backend descriptions, causes, and trailers. Use a fixed invalid-ciphertext message and verify that wrapped exceptions cannot expose backend secrets. ai-assisted=yes TNZGOV-447
dlinsley
left a comment
dlinsley
left a comment
There was a problem hiding this comment.
Thanks for the changes!
github-project-automation
Bot
moved this from Inbox
to Pending Merge | Prioritized
in Foundational Infrastructure Working Group
github-project-automation
Bot
moved this from Pending Merge | Prioritized
to Done
in Foundational Infrastructure Working Group
Log only the operation and gRPC status code on encryption and decryption failures. Add regression coverage for request payloads and secret-bearing backend errors.
ai-assisted=yes
TNZGOV-447