Jira (PUP-9787) Unintentional secret reveal while installing modules

[Chris Suszynski (JIRA)]

Title: Message Title

Chris Suszynski created an issue   Puppet / PUP-9787 Unintentional secret reveal while installing modules Issue Type: Bug Affects Versions: PUP 4.10.0 Assignee: Unassigned Components: Modules Created: 2019/06/19 3:45 PM Priority: Minor Reporter: Chris Suszynski Puppet Version: any Puppet Server Version: any OS Name/Version: any Actual Behavior: Puppet Forge is public, and downloading modules don't require authentication. However there are some repositories that can hold modules and require authentication to connect. Those repositories are: Artifactory (live) Nexus (emerging) (emerging) When installing modules from those repositories user is forced to set his credentials in plain text in URI supported form, for ex.: https://admin:s3c...@pkg.acmecorp.com/repository/puppet Installing modules with similar module repository being set, reveals those credentials. In fact it's done each time a module is installed, with a message: Notice: Preparing to install into /home/jdoe/.puppetlabs/etc/code/modules ... Notice: Downloading from https://jdoe:s3c...@pkg.acmecorp.com/repository/puppet ... Desired Behavior: Puppet should mask password if given, like this: Notice: Preparing to install into /home/jdoe/.puppetlabs/etc/code/modules ... Notice: Downloading from https://jdoe:***@pkg.acmecorp.com/repository/puppet ...   Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.313276.1560984349000.54328.1560984361238%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.