Skip to content

Commit 0a4a778

Browse files
VietND96frudisch
VietND96
and
frudisch
authored
fix: mask secret info from bash logs (#2360)
* Do not print secrets such as registration secret and router password to console on selenium grid hub and router startup (#2359) * fix: mask secret info from bash logs Signed-off-by: Viet Nguyen Duc <nguyenducviet4496@gmail.com> --------- Signed-off-by: Viet Nguyen Duc <nguyenducviet4496@gmail.com> Co-authored-by: Florian Rudisch <frudisch@users.noreply.github.com>
1 parent 40676da commit 0a4a778

13 files changed

+48
-20
lines changed

‎Base/Dockerfile

+1
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,7 @@ RUN if [ "$(dpkg --print-architecture)" = "amd64" ]; then \
128128
# Add Grid check script
129129
#======================================
130130
COPY --chown="${SEL_UID}:${SEL_GID}" check-grid.sh entry_point.sh configs/node/nodeGridUrl.sh configs/node/nodePreStop.sh /opt/bin/
131+
COPY --chown="${SEL_UID}:${SEL_GID}" mask /usr/local/bin/
131132

132133
#======================================
133134
# Add Supervisor configuration file

‎Base/mask

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/usr/bin/env bash
2+
3+
SE_MASK_SECRETS_MIN_LENGTH=${SE_MASK_SECRETS_MIN_LENGTH:-3}
4+
SE_MASK_SECRETS_KEEP_LAST=${SE_MASK_SECRETS_KEEP_LAST:-0}
5+
if [ "${SE_MASK_SECRETS:-true}" = "true" ]; then
6+
n=${SE_MASK_SECRETS_KEEP_LAST}
7+
[[ ${#1} -le ${SE_MASK_SECRETS_MIN_LENGTH} ]] && n=$(( ${#1} - ${SE_MASK_SECRETS_MIN_LENGTH} ))
8+
a="${1:0:${#1}-n}"
9+
a="${a:0:${SE_MASK_SECRETS_MIN_LENGTH}}"
10+
b="${1:${#1}-n}"
11+
printf "%s%s" "${a//?/*}" "$b"
12+
else
13+
printf "%s" "$1"
14+
fi

‎Distributor/start-selenium-grid-distributor.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
8585
SE_JAVA_SSL_TRUST_STORE_PASSWORD="$(cat ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
8686
fi
8787
if [ ! -z "${SE_JAVA_SSL_TRUST_STORE_PASSWORD}" ]; then
88-
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword"
88+
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword=$(mask ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
8989
SE_JAVA_OPTS="$SE_JAVA_OPTS -Djavax.net.ssl.trustStorePassword=${SE_JAVA_SSL_TRUST_STORE_PASSWORD}"
9090
fi
9191
echo "Appending Java options: -Djdk.internal.httpclient.disableHostnameVerification=${SE_JAVA_DISABLE_HOSTNAME_VERIFICATION}"
@@ -102,7 +102,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
102102
fi
103103

104104
if [ ! -z "$SE_REGISTRATION_SECRET" ]; then
105-
echo "Appending Selenium options: --registration-secret ${SE_REGISTRATION_SECRET}"
105+
echo "Appending Selenium options: --registration-secret $(mask ${SE_REGISTRATION_SECRET})"
106106
SE_OPTS="$SE_OPTS --registration-secret ${SE_REGISTRATION_SECRET}"
107107
fi
108108

‎EventBus/start-selenium-grid-eventbus.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
5050
SE_JAVA_SSL_TRUST_STORE_PASSWORD="$(cat ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
5151
fi
5252
if [ ! -z "${SE_JAVA_SSL_TRUST_STORE_PASSWORD}" ]; then
53-
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword"
53+
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword=$(mask ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
5454
SE_JAVA_OPTS="$SE_JAVA_OPTS -Djavax.net.ssl.trustStorePassword=${SE_JAVA_SSL_TRUST_STORE_PASSWORD}"
5555
fi
5656
echo "Appending Java options: -Djdk.internal.httpclient.disableHostnameVerification=${SE_JAVA_DISABLE_HOSTNAME_VERIFICATION}"

‎Hub/start-selenium-grid-hub.sh

+3-3
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
5353
SE_JAVA_SSL_TRUST_STORE_PASSWORD="$(cat ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
5454
fi
5555
if [ ! -z "${SE_JAVA_SSL_TRUST_STORE_PASSWORD}" ]; then
56-
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword"
56+
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword=$(mask ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
5757
SE_JAVA_OPTS="$SE_JAVA_OPTS -Djavax.net.ssl.trustStorePassword=${SE_JAVA_SSL_TRUST_STORE_PASSWORD}"
5858
fi
5959
echo "Appending Java options: -Djdk.internal.httpclient.disableHostnameVerification=${SE_JAVA_DISABLE_HOSTNAME_VERIFICATION}"
@@ -70,7 +70,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
7070
fi
7171

7272
if [ ! -z "$SE_REGISTRATION_SECRET" ]; then
73-
echo "Appending Selenium options: --registration-secret ${SE_REGISTRATION_SECRET}"
73+
echo "Appending Selenium options: --registration-secret $(mask ${SE_REGISTRATION_SECRET})"
7474
SE_OPTS="$SE_OPTS --registration-secret ${SE_REGISTRATION_SECRET}"
7575
fi
7676

@@ -85,7 +85,7 @@ if [ ! -z "$SE_ROUTER_USERNAME" ]; then
8585
fi
8686

8787
if [ ! -z "$SE_ROUTER_PASSWORD" ]; then
88-
echo "Appending Selenium options: --password ${SE_ROUTER_PASSWORD}"
88+
echo "Appending Selenium options: --password $(mask ${SE_ROUTER_PASSWORD})"
8989
SE_OPTS="$SE_OPTS --password ${SE_ROUTER_PASSWORD}"
9090
fi
9191

‎NodeBase/start-selenium-node.sh

+4-2
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ function append_se_opts() {
1919
if [[ "${SE_OPTS}" != *"${option}"* ]]; then
2020
if [ "${log_message}" = "true" ]; then
2121
echo "Appending Selenium option: ${option} ${value}"
22+
else
23+
echo "Appending Selenium option: ${option} $(mask ${value})"
2224
fi
2325
SE_OPTS="${SE_OPTS} ${option}"
2426
if [ ! -z "${value}" ]; then
@@ -99,7 +101,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
99101
SE_JAVA_SSL_TRUST_STORE_PASSWORD="$(cat ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
100102
fi
101103
if [ ! -z "${SE_JAVA_SSL_TRUST_STORE_PASSWORD}" ]; then
102-
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword"
104+
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword=$(mask ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
103105
SE_JAVA_OPTS="$SE_JAVA_OPTS -Djavax.net.ssl.trustStorePassword=${SE_JAVA_SSL_TRUST_STORE_PASSWORD}"
104106
fi
105107
echo "Appending Java options: -Djdk.internal.httpclient.disableHostnameVerification=${SE_JAVA_DISABLE_HOSTNAME_VERIFICATION}"
@@ -114,7 +116,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
114116
fi
115117

116118
if [ ! -z "$SE_REGISTRATION_SECRET" ]; then
117-
append_se_opts "--registration-secret" "${SE_REGISTRATION_SECRET}"
119+
append_se_opts "--registration-secret" "${SE_REGISTRATION_SECRET}" "false"
118120
fi
119121

120122
if [ "$GENERATE_CONFIG" = true ]; then

‎NodeDocker/start-selenium-grid-docker.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
7373
SE_JAVA_SSL_TRUST_STORE_PASSWORD="$(cat ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
7474
fi
7575
if [ ! -z "${SE_JAVA_SSL_TRUST_STORE_PASSWORD}" ]; then
76-
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword"
76+
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword=$(mask ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
7777
SE_JAVA_OPTS="$SE_JAVA_OPTS -Djavax.net.ssl.trustStorePassword=${SE_JAVA_SSL_TRUST_STORE_PASSWORD}"
7878
fi
7979
echo "Appending Java options: -Djdk.internal.httpclient.disableHostnameVerification=${SE_JAVA_DISABLE_HOSTNAME_VERIFICATION}"

‎README.md

+10-1
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ Talk to us at https://www.selenium.dev/support/
6464
* [Running in Headless mode](#running-in-headless-mode)
6565
* [Stopping the Node/Standalone after N sessions have been executed](#stopping-the-nodestandalone-after-n-sessions-have-been-executed)
6666
* [Automatic browser leftovers cleanup](#automatic-browser-leftovers-cleanup)
67+
* [Mask sensitive information in console logs](#mask-sensitive-information-in-console-logs)
6768
* [Secure Connection](#secure-connection)
6869
* [Building the images](#building-the-images)
6970
* [Build the images with specific versions](#build-the-images-with-specific-versions)
@@ -1092,7 +1093,7 @@ By default, Selenium is reachable at `http://127.0.0.1:4444/`. Selenium can be c
10921093
environmental variable. In the example below Selenium is reachable at `http://127.0.0.1:4444/selenium-grid/`
10931094

10941095
```bash
1095-
$ docker run -d -p 4444:4444 -e SE_SUB_PATH=/selenium-grid/ --name selenium-hub selenium/hub:4.9.0-20230421
1096+
$ docker run -d -p 4444:4444 -e SE_SUB_PATH=/selenium-grid/ --name selenium-hub selenium/hub:4.23.1-20240813
10961097
```
10971098

10981099
### Setting Screen Resolution
@@ -1208,6 +1209,14 @@ running longer than 1 hour (instead of 2 hours), and will remove temp files olde
12081209

12091210
---
12101211

1212+
## Mask sensitive information in console logs
1213+
1214+
Few variables output like password, secret, etc. are masked in console logs. For debugging purposes, you can disable it by setting `SE_MASK_SECRETS` to `false`
1215+
1216+
While creating bash script, your can mask the output by using syntax `echo "Current value is $(mask ${YOUR_VARIABLE})`
1217+
1218+
`SE_MASK_SECRETS_MIN_LENGTH` default is `3`. It means a long string will be masked to `***` to avoid exposing length for brute force attack.
1219+
12111220
## Secure connection
12121221

12131222
By default, there are default self-signed certificates available in the image in location `/opt/selenium/secrets` includes

‎Router/start-selenium-grid-router.sh

+3-3
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
8585
SE_JAVA_SSL_TRUST_STORE_PASSWORD="$(cat ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
8686
fi
8787
if [ ! -z "${SE_JAVA_SSL_TRUST_STORE_PASSWORD}" ]; then
88-
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword"
88+
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword=$(mask ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
8989
SE_JAVA_OPTS="$SE_JAVA_OPTS -Djavax.net.ssl.trustStorePassword=${SE_JAVA_SSL_TRUST_STORE_PASSWORD}"
9090
fi
9191
echo "Appending Java options: -Djdk.internal.httpclient.disableHostnameVerification=${SE_JAVA_DISABLE_HOSTNAME_VERIFICATION}"
@@ -102,7 +102,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
102102
fi
103103

104104
if [ ! -z "$SE_REGISTRATION_SECRET" ]; then
105-
echo "Appending Selenium options: --registration-secret ${SE_REGISTRATION_SECRET}"
105+
echo "Appending Selenium options: --registration-secret $(mask ${SE_REGISTRATION_SECRET})"
106106
SE_OPTS="$SE_OPTS --registration-secret ${SE_REGISTRATION_SECRET}"
107107
fi
108108

@@ -117,7 +117,7 @@ if [ ! -z "$SE_ROUTER_USERNAME" ]; then
117117
fi
118118

119119
if [ ! -z "$SE_ROUTER_PASSWORD" ]; then
120-
echo "Appending Selenium options: --password ${SE_ROUTER_PASSWORD}"
120+
echo "Appending Selenium options: --password $(mask ${SE_ROUTER_PASSWORD})"
121121
SE_OPTS="$SE_OPTS --password ${SE_ROUTER_PASSWORD}"
122122
fi
123123

‎SessionQueue/start-selenium-grid-session-queue.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
5050
SE_JAVA_SSL_TRUST_STORE_PASSWORD="$(cat ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
5151
fi
5252
if [ ! -z "${SE_JAVA_SSL_TRUST_STORE_PASSWORD}" ]; then
53-
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword"
53+
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword=$(mask ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
5454
SE_JAVA_OPTS="$SE_JAVA_OPTS -Djavax.net.ssl.trustStorePassword=${SE_JAVA_SSL_TRUST_STORE_PASSWORD}"
5555
fi
5656
echo "Appending Java options: -Djdk.internal.httpclient.disableHostnameVerification=${SE_JAVA_DISABLE_HOSTNAME_VERIFICATION}"
@@ -67,7 +67,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
6767
fi
6868

6969
if [ ! -z "$SE_REGISTRATION_SECRET" ]; then
70-
echo "Appending Selenium options: --registration-secret ${SE_REGISTRATION_SECRET}"
70+
echo "Appending Selenium options: --registration-secret $(mask ${SE_REGISTRATION_SECRET})"
7171
SE_OPTS="$SE_OPTS --registration-secret ${SE_REGISTRATION_SECRET}"
7272
fi
7373

‎Sessions/start-selenium-grid-sessions.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
6565
SE_JAVA_SSL_TRUST_STORE_PASSWORD="$(cat ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
6666
fi
6767
if [ ! -z "${SE_JAVA_SSL_TRUST_STORE_PASSWORD}" ]; then
68-
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword"
68+
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword=$(mask ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
6969
SE_JAVA_OPTS="$SE_JAVA_OPTS -Djavax.net.ssl.trustStorePassword=${SE_JAVA_SSL_TRUST_STORE_PASSWORD}"
7070
fi
7171
echo "Appending Java options: -Djdk.internal.httpclient.disableHostnameVerification=${SE_JAVA_DISABLE_HOSTNAME_VERIFICATION}"
@@ -82,7 +82,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
8282
fi
8383

8484
if [ ! -z "$SE_REGISTRATION_SECRET" ]; then
85-
echo "Appending Selenium options: --registration-secret ${SE_REGISTRATION_SECRET}"
85+
echo "Appending Selenium options: --registration-secret $(mask ${SE_REGISTRATION_SECRET})"
8686
SE_OPTS="$SE_OPTS --registration-secret ${SE_REGISTRATION_SECRET}"
8787
fi
8888

‎Standalone/start-selenium-standalone.sh

+4-2
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ function append_se_opts() {
1919
if [[ "${SE_OPTS}" != *"${option}"* ]]; then
2020
if [ "${log_message}" = "true" ]; then
2121
echo "Appending Selenium option: ${option} ${value}"
22+
else
23+
echo "Appending Selenium option: ${option} $(mask ${value})"
2224
fi
2325
SE_OPTS="${SE_OPTS} ${option}"
2426
if [ ! -z "${value}" ]; then
@@ -47,7 +49,7 @@ if [ ! -z "$SE_ROUTER_USERNAME" ]; then
4749
fi
4850

4951
if [ ! -z "$SE_ROUTER_PASSWORD" ]; then
50-
append_se_opts "--password" "${SE_ROUTER_PASSWORD}"
52+
append_se_opts "--password" "${SE_ROUTER_PASSWORD}" "false"
5153
fi
5254

5355
if [ ! -z "$SE_NODE_ENABLE_MANAGED_DOWNLOADS" ]; then
@@ -97,7 +99,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
9799
SE_JAVA_SSL_TRUST_STORE_PASSWORD="$(cat ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
98100
fi
99101
if [ ! -z "${SE_JAVA_SSL_TRUST_STORE_PASSWORD}" ]; then
100-
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword"
102+
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword=$(mask ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
101103
SE_JAVA_OPTS="$SE_JAVA_OPTS -Djavax.net.ssl.trustStorePassword=${SE_JAVA_SSL_TRUST_STORE_PASSWORD}"
102104
fi
103105
echo "Appending Java options: -Djdk.internal.httpclient.disableHostnameVerification=${SE_JAVA_DISABLE_HOSTNAME_VERIFICATION}"

‎StandaloneDocker/start-selenium-grid-docker.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ if [ "${SE_ENABLE_TLS}" = "true" ]; then
7878
SE_JAVA_SSL_TRUST_STORE_PASSWORD="$(cat ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
7979
fi
8080
if [ ! -z "${SE_JAVA_SSL_TRUST_STORE_PASSWORD}" ]; then
81-
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword"
81+
echo "Appending Java options: -Djavax.net.ssl.trustStorePassword=$(mask ${SE_JAVA_SSL_TRUST_STORE_PASSWORD})"
8282
SE_JAVA_OPTS="$SE_JAVA_OPTS -Djavax.net.ssl.trustStorePassword=${SE_JAVA_SSL_TRUST_STORE_PASSWORD}"
8383
fi
8484
echo "Appending Java options: -Djdk.internal.httpclient.disableHostnameVerification=${SE_JAVA_DISABLE_HOSTNAME_VERIFICATION}"

0 commit comments

Comments
 (0)