Page MenuHomePhabricator

[envvars-cli] Add option to not show envvar values when listing
Closed, ResolvedPublic

Description

Given that envvars are often used for secrets, IMHO it would be useful to have a mode that only lists the defined variable names without their values. (I’m even tempted to say it should be the default, to be honest.) This was previously discussed in T340005, but the outcome there was to truncate the values to 50 characters, which is enough to fully “leak” many secrets (even OAuth consumer secrets for Wikimedia wikis are shorter than that).

Currently, the only way to list envvars without values is using questionable pipelines or unsupported low-level APIs (I think):

$ toolforge envvars list | awk '{ print $1 }'
$ toolforge envvars list --json | jq -r '.[] | .name'
$ kubectl get secrets

Event Timeline

Two use-cases I have in mind:

  • debugging a tool with someone else who is “shoulder surfing”
  • publicly documenting the defined envvars (“the tool expects the following variables to be set: envvars list command + output”)

CC @Slst2020 who just ran toolforge envvars list in T362062: [Session] Toolforge & Cloud VPS demos (the only variable that was truncated at 50 characters was the Django secret key) – she said she’s gonna change the credentials afterwards, but IMHO it would’ve been better if the command hadn’t shown them to the whole room in the first place :)

CC @Slst2020 who just ran toolforge envvars list in T362062: [Session] Toolforge & Cloud VPS demos (the only variable that was truncated at 50 characters was the Django secret key) – she said she’s gonna change the credentials afterwards, but IMHO it would’ve been better if the command hadn’t shown them to the whole room in the first place :)

In this case it was intentional for demo purposes, but I agree that there is a use case for hiding the envvars when listing, perhaps as a default.

dcaro triaged this task as Medium priority.May 15 2024, 1:37 PM
Raymond_Ndibe subscribed.

This makes sense. it should default to hidden by default, maybe just printing out a * * * * * * * placeholder instead. If someone really wants to view the value, maybe that can be done in a show subcommand or a flag to make the values visible.

Raymond_Ndibe changed the task status from Open to In Progress.Apr 13 2025, 5:06 AM
Raymond_Ndibe claimed this task.

Envvars list now shows asterisks:

local.tf-test@toolslocal:~$ toolforge envvars list
name    value
TEST1   ****************
TEST2   ****************

unless --show-values is passed:

local.tf-test@toolslocal:~$ toolforge envvars list --show-values
name    value
TEST1   some value
TEST2   osnaethaoenst ontoeah nstuoahenuthoaentsuhaoentshuaonetshunsaothunsaot hunstoa unstha snuthoaesnuth aoensth