encrypted_secret_token and encrypted_secret_token_iv are exposed in Snippets#hook_attrs
It looks like secret_token
was introduced in !19939 (merged), but never completed.
However, the introduction of this attr_encrypted
column means that encrypted_secret_token
and encrypted_secret_token_iv
are exposed to integrations and webhooks.
Could we remove this encrypted column, given it seems not used ?
/cc @engwan @gitlab-com/gl-security/appsec @.luke
Below is example data when I trigger a integration by adding a new note on a snippet. (in app/services/notes/post_process_service.rb
{:object_kind=>"note", :event_type=>"note", :user=>{:id=>1, :name=>"Administrator", :username=>"root", :avatar_url=>"https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon", :email=>"admin2@example.com"}, :project_id=>49, :project=>{:id=>49, :name=>"039893q4", :description=>nil, :web_url=>"http://gdk.test:8787/root/039893q4", :avatar_url=>nil, :git_ssh_url=>"ssh://git@127.0.0.1:2222/root/039893q4.git", :git_http_url=>"http://gdk.test:8787/root/039893q4.git", :namespace=>"Administrator", :visibility_level=>0, :path_with_namespace=>"root/039893q4", :default_branch=>nil, :ci_config_path=>nil, :homepage=>"http://gdk.test:8787/root/039893q4", :url=>"ssh://git@127.0.0.1:2222/root/039893q4.git", :ssh_url=>"ssh://git@127.0.0.1:2222/root/039893q4.git", :http_url=>"http://gdk.test:8787/root/039893q4.git"}, :object_attributes=>{"attachment"=>nil, "author_id"=>1, "change_position"=>nil, "commit_id"=>nil, "created_at"=>Mon, 05 Feb 2024 08:48:34.074144000 UTC +00:00, "discussion_id"=>"41557312ef0cc88c828f03fff58a3787c37c5d9e", "id"=>1381, "line_code"=>nil, "note"=>"go go go", "noteable_id"=>21, "noteable_type"=>"Snippet", "original_position"=>nil, "position"=>nil, "project_id"=>49, "resolved_at"=>nil, "resolved_by_id"=>nil, "resolved_by_push"=>nil, "st_diff"=>nil, "system"=>false, "type"=>nil, "updated_at"=>Mon, 05 Feb 2024 08:48:34.074144000 UTC +00:00, "updated_by_id"=>nil, "description"=>"go go go", "url"=>"http://gdk.test:8787/root/039893q4/-/snippets/21#note_1381"}, :repository=>{:name=>"039893q4", :url=>"ssh://git@127.0.0.1:2222/root/039893q4.git", :description=>nil, :homepage=>"http://gdk.test:8787/root/039893q4"}, :snippet=>{"id"=>21, "title"=>"dasdas", "content"=>"adsadsaed", "author_id"=>1, "project_id"=>49, "created_at"=>Mon, 05 Feb 2024 08:34:10.111166000 UTC +00:00, "updated_at"=>Mon, 05 Feb 2024 08:48:34.163515000 UTC +00:00, "file_name"=>"a.txt", "type"=>"ProjectSnippet", "visibility_level"=>0, "description"=>"asdas", "encrypted_secret_token"=>"3/n2j+TZnOSanfYJBIrbZA==\n", "encrypted_secret_token_iv"=>"9Fdn5RwVmdh+w7QaCU4ROg==\n", "secret"=>false, "repository_read_only"=>false, "secret_token"=>nil, "url"=>"http://gdk.test:8787/root/039893q4/-/snippets/21"}}
Edited by Thong Kuah