This commit is contained in:
Eddy Filip
2021-08-03 19:18:04 +02:00
parent 6bfaeeb67d
commit adde26c41b

View File

@@ -55,21 +55,18 @@ for env_var in $(op list envars); do
exit 1 exit 1
fi fi
# If the field is marked as concealed or is a note, register a mask # Register a mask for the secret to prevent accidental log exposure.
# for the secret to prevent accidental log exposure. # To support multiline secrets, escape percent signs and add a mask per line.
if [ "$field_type" == "CONCEALED" ] || [ "$field_purpose" == "NOTES" ]; then escaped_mask_value=$(echo "$secret_value" | sed -e 's/%/%25/g')
# To support multiline secrets, escape percent signs and add a mask per line. IFS=$'\n'
escaped_mask_value=$(echo "$secret_value" | sed -e 's/%/%25/g') for line in $escaped_mask_value; do
IFS=$'\n' if [ "${#line}" -lt 3 ]; then
for line in $escaped_mask_value; do # To avoid false positives and unreadable logs, omit mask for lines that are too short.
if [ "${#line}" -lt 3 ]; then continue
# To avoid false positives and unreadable logs, omit mask for lines that are too short. fi
continue echo "::add-mask::$line"
fi done
echo "::add-mask::$line" unset IFS
done
unset IFS
fi
# To support multiline secrets, we'll use the heredoc syntax to populate the environment variables. # To support multiline secrets, we'll use the heredoc syntax to populate the environment variables.
# As the heredoc identifier, we'll use a randomly generated 64-character string, # As the heredoc identifier, we'll use a randomly generated 64-character string,