v3 of this task can leak secrets in debug mode, solved with upgrade to v6

[Roald87]

I wanted to post this here as well, to make sure people upgrade to v6 of this task. I've seen that v3 of this task can leak some secrets when run in debug mode.

A copy of my stackoverflow question:

I have three Azure CD pipelines that follow similar steps. All three use a similarly named and used key that they fetch from a key vault. When I enable debug mode, the secret shows up in the logs of one deployment to a certain tenant.

Say I have these keys:

• tenant1-pipelineA-secret << only this shows in debug logs
• tenant2-pipelineA-secret << always redacted
• tenant1-pipelineB-secret << always redacted
• tenant2-pipelineB-secret << always redacted
• tenant1-pipelineB-secret << always redacted
• tenant2-pipelineB-secret << always redacted

The secret is only visible if system.Debug is set to true in the CD pipeline log that uses tenant1-pipelineA-secret. The strange thing is that this exact same secret is redacted with *** in a normal print statement of the same pipeline.

So the Azure pipeline logs look like this:

...
##[debug]tenant1-pipelineA-secret: "abcdefg123"
...
tenant1-pipelineA-secret: "***"

All the other CD pipelines, and the CD pipeline to tenant2, never show the secret in plain text, also not if system.Debug is enabled.

My suspicion is that the tenant1-pipelineA-secret key contains a special character that trips up the Azure key redaction step. Although I'm not sure why that only fails for a ##[debug] line, but not for a normal print. The keys are automatically generated and can contain the following characters: *!%#_/@-.

Any ideas why this one key is shown?

[qetza]

Hi @Roald87,
Thanks for reporting the issue. Based on your message I think that there is some issue in the azure pipelines task lib used by the v3 task which is an old version of the lib and the issue was fixed in newer version of the lib.

[WoodhamsR]

Hi - posting here as it seems related (?)

I found that debug level logging actually replaced the tokens with ***, so they're redacted in both the log output and the file!

      - task: ReplaceTokens@6
        inputs:
          root: "$(Build.SourcesDirectory)/Test"
          escape: off
          logLevel: debug
          sources: |
            **/*.json
          additionalVariables: |
            - gatewayUserName: '$(administratorUsername)'
              gatewayPassword: '$(administratorPassword)'
              gatewayDomain: '$(Agent.Name)'

I removed logLevel: debug and the values are injected correctly. Something to be aware of in v6.

[qetza]

HI @WoodhamsR,

I'll look at this but it's strange as the task doesn't do any redaction internally (there is no notion of secrets, everything is a value), the redaction part is done by the azure pipeline agent.