Description of problem:
mask_passwords doesn't mask characters following a " so if a user has a password containing a " in the middle such as pass"word , we would see ***"word in the debug output.
It looks like something's wrong with this:
_FORMAT_PATTERNS_1 = [r'(%(key)s[0-9]*\s*[=]\s*)[^\s^\'^\"]+']
_FORMAT_PATTERNS_2 = [r'(%(key)s[0-9]*\s*[=]\s*[\"\'])[^\"\']*([\"\'])',
r'(%(key)s[0-9]*\s+[\"\'])[^\"\']*([\"\'])',
r'([-]{2}%(key)s[0-9]*\s+)[^\'^\"^=^\s]+([\s]*)',
r'(<%(key)s[0-9]*>)[^<]*(</%(key)s[0-9]*>)',
r'([\"\']%(key)s[0-9]*[\"\']\s*:\s*[\"\'])[^\"\']*'
r'([\"\'])',
r'([\'"][^"\']*%(key)s[0-9]*[\'"]\s*:\s*u?[\'"])[^\"\']*'
r'([\'"])',
r'([\'"][^\'"]*%(key)s[0-9]*[\'"]\s*,\s*\'--?[A-z]+'
r'\'\s*,\s*u?[\'"])[^\"\']*([\'"])',
r'(%(key)s[0-9]*\s*--?[A-z]+\s*)\S+(\s*)']
Version-Release number of selected component (if applicable):
All
How reproducible:
Always
Steps to Reproduce:
1. Set a password containing a " somewhere in it
2. Use openstack --debug CLI
3.
Actual results:
Password are not fully hidden
Expected results:
No password should leak in debug output
Additional informations:
We can also reproduce it by adding a dedicated unit tests:
```
payload = 'test = "original_password" : "aaaaa"aaaa"'
expected = 'test = "original_password" : "***"'
self.assertEqual(expected, strutils.mask_password(payload))
```
It will provide the following outcome:
```oslo_utils.tests.test_strutils.MaskPasswordTestCase.test_mask_password
----------------------------------------------------------------------
Captured traceback:
~~~~~~~~~~~~~~~~~~~
Traceback (most recent call last):
File "/home/hberaud/dev/oslo/oslo.utils/oslo_utils/tests/test_strutils.py", line 612, in test_mask_password
self.assertEqual(expected, strutils.mask_password(payload))
File "/home/hberaud/dev/oslo.utils/.tox/py38/lib/python3.8/site-packages/testtools/testcase.py", line 393, in assertEqual
self.assertThat(observed, matcher, message)
File "/home/hberaud/dev/oslo.utils/.tox/py38/lib/python3.8/site-packages/testtools/testcase.py", line 480, in assertThat
raise mismatch_error
testtools.matchers._impl.MismatchError: !=:
reference = 'test = "original_password" : "***"'
actual = 'test = "original_password" : "***"aaaa"'
```
I'll debug the regex to see how we can fix that.
Fix proposed to branch: master
Review: https:/