Jira (PUP-9295) Notify resource exposes Sensitive data when message is a Sensitive data

[Josh Cooper (JIRA)]

Title: Message Title

Josh Cooper commented on PUP-9295   Re: Notify resource exposes Sensitive data when message is a Sensitive data The Puppet::Pops::Types::PSensitiveType#to_s method is only called in the third case, I assume as a result of interpolating the sensitive message in a string. One fix is to do the following, but it feels like a game of "whack a mole" as every type/provider needs to check if it's been given a sensitive property/parameter: diff --git a/lib/puppet/type/notify.rb b/lib/puppet/type/notify.rb index 96830aa91b..aa7cb5603b 100644 --- a/lib/puppet/type/notify.rb +++ b/lib/puppet/type/notify.rb @@ -11,11 +11,12 @@ module Puppet newproperty(:message, :idempotent => false) do desc "The message to be sent to the log." def sync + message = @sensitive ? 'Sensitive [value redacted]' : self.should case @resource["withpath"] when :true - send(@resource[:loglevel], self.should) + send(@resource[:loglevel], message) else - Puppet.send(@resource[:loglevel], self.should) + Puppet.send(@resource[:loglevel], message) end return end $ bundle exec puppet apply manifest.pp Notice: Compiled catalog for localhost in environment production in 0.02 seconds Notice: Sensitive [value redacted] Notice: /Stage[main]/Main/Notify[Sensitive message 1]/message: changed [redacted] to [redacted] Notice: Sensitive [value redacted] Notice: /Stage[main]/Main/Notify[Sensitive message 2]/message: changed [redacted] to [redacted] Notice: Sensitive [value redacted] Notice: /Stage[main]/Main/Notify[Sensitive message 3]/message: defined 'message' as 'Sensitive [value redacted]' Notice: Applied catalog in 0.01 seconds Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.