Sensitive variables printed when exec fails

[mikravn]

Describe the bug

When exec runs with sensitive arguments, and the command returns a bad exit code (e.g. a script or program) it dumps sensitive values in errout. It is not expected that sensitive variables are printed in plain text.

To Reproduce

Run porter build && porter install with the following porter.xml:

schemaType: Bundle

schemaVersion: 1.0.1

name: porter-hello

version: 0.1.0

description: "An example Porter configuration"

registry: "localhost:5000"

mixins:
  - exec

parameters:
  - name: secret
    type: string
    default: "---I AM A SECRET VALU1E---"
    sensitive: true

install:
  - exec:
      command: false # /bin/false is a simple way to reproduce, but this could be a program or script.
      arguments:
        - "${bundle.parameters.secret}"
        
upgrade:
  - exec:
      command: true

uninstall:
  - exec:
      command: true

Expected behavior

The sensitive value should never be logged out in plain text.

Porter Command and Output

Cmd:

porter build && porter install

Output:

[ ... build output cut as not relevant ...]
Just-in-time resolving credentials...
Just-in-time resolving parameters...
executing install action from porter-hello (installation: /porter-hello)
error running command /cnab/app /usr/bin/false *******: exit status 1
Error: error running command /cnab/app /usr/bin/false *******: exit status 1
1 error occurred:
        * mixin execution failed: package command failed /cnab/app/cnab/app/mixins/exec/runtimes/exec-runtime install
error running command /cnab/app /usr/bin/false ---I AM A SECRET VALU1E---: exit status 1
Error: error running command /cnab/app /usr/bin/false ---I AM A SECRET VALU1E---: exit status 1



1 error occurred:
        * mixin execution failed: package command failed /cnab/app/cnab/app/mixins/exec/runtimes/exec-runtime install
error running command /cnab/app /usr/bin/false ---I AM A SECRET VALU1E---: exit status 1
Error: error running command /cnab/app /usr/bin/false ---I AM A SECRET VALU1E---: exit status 1



1 error occurred:
        * container exit code: 1, message: <nil>

Version

porter v1.1.0 (b50c189)

[hgupta12]

Can I take up this issue?

[kichristensen]

@hgupta12 Sorry for the late reply. It would be great if you would take a look it, just let us know if you need any help or guidance.

[hgupta12]

@kichristensen Sure! Could you please assign it to me?