Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Credentials exposed in getProjectDetails api #77

Open
minghao-wang opened this issue May 27, 2021 · 1 comment
Open

Credentials exposed in getProjectDetails api #77

minghao-wang opened this issue May 27, 2021 · 1 comment
Labels
enhancement New feature or request good first issue Good for newcomers

Comments

@minghao-wang
Copy link

Describe the bug
Credentials exposed in getProjectDetails api, this may lead to a security issue.

To Reproduce
Steps to reproduce the behavior:

  1. open Chrom DevTools, go to Network tab
  2. Select one GET /api/project/XXXX
  3. Hit Preview, there is crendential info in the pipeline list

Expected behavior
Should hide crendential of the pipelines

@hyrepo
Copy link
Collaborator

hyrepo commented May 31, 2021

Hi @minghao-wang, thanks for the feedback.

When we develop the application we tried to make it as minimal as possible, so we can deliver a usable version quickly, therefore, only data in the database was encrypted, and the responsibility of transport layer safety is leveraged to users. But now since we don't have pressure on a timeline I think we can make it better as you mentioned.

@hyrepo hyrepo added the enhancement New feature or request label May 31, 2021
@hyrepo hyrepo added the good first issue Good for newcomers label Sep 27, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

2 participants