Password used by plugin shows up in debug mode

[Lin Hua Cheng]

Steps to reproduce:
1. Run OSC in debug mode.

Expected result:
Password should not show up

Actual result:
Password shows up

Output from terminal running OSC command:
$ openstack account set --property test=me --debug
START with options: ['account', 'set', '--property', 'test=me', '--debug']
...
compute API version 2, cmd group openstack.compute.v2
...
command: account set -> openstackclient.object.v1.account.SetAccount
Auth plugin osc_password selected
Password:
auth_type: osc_password
Using auth plugin: osc_password
Using parameters {'username': 'admin', 'tenant_name': 'admin', 'project_name': 'admin', 'password': '<PASSWORD LOGGED!!!>', 'auth_url': 'http://10.0.2.15:5000/v2.0'}

[Steve Martinelli (stevemar)]

the code in question is here: https://github.com/openstack/python-openstackclient/blob/9c492b742d1128bfb8ac291889e1e5d6c9d25b88/openstackclient/common/clientmanager.py#L170

is there a standard for blocking out any field that contains the key 'password' or 'secret'? I feel like there are probably fields aside from password that should be blocked out

[Steve Martinelli (stevemar)]

@lin, in addition to 'password', we should also check 'secret' and 'token', i'm thinking of --client-secret for the openID stuff, and the admin token

[Lin Hua Cheng (lin-hua-cheng)]

@steve: good catch! updated the patch

[Lin Hua Cheng (lin-hua-cheng)]

I've consulted the security team about the issue. Password leak for DEBUG level have never issued advisories and always classified as security hardening improvements instead.

similar to this issue in nova:
https://bugs.launchpad.net/nova/+bug/1492140

I'm going to open this as public security

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/233271

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/233271
Committed: https://git.openstack.org/cgit/openstack/python-openstackclient/commit/?id=f0a81c284d2f533e0fe8adc747c5bd0532a7684f
Submitter: Jenkins
Branch: master

commit f0a81c284d2f533e0fe8adc747c5bd0532a7684f
Author: lin-hua-cheng <email address hidden>
Date: Tue Oct 6 20:42:40 2015 -0700

    Mask the sensitive values in debug log

    Change-Id: I0eb11a648c3be21749690f079229c8e63a678e6c
    Closes-Bug: #1501598

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/liberty
Review: https://review.openstack.org/382698

[OpenStack Infra (hudson-openstack)]

Change abandoned by Joshua Hesketh (<email address hidden>) on branch: stable/liberty
Review: https://review.openstack.org/382698
Reason: This branch (stable/liberty) is at End Of Life