[I] [Bug][API] GET /projects exposes GitLab token in the gitextractor plugi [incubator-devlake]

["richard-fletcher (via GitHub)" <gi...@apache.org>]

richard-fletcher opened a new issue, #7597:
URL: https://github.com/apache/incubator-devlake/issues/7597

   ### Search before asking
   
   - [X] I had searched in the [issues](https://github.com/apache/incubator-devlake/issues?q=is%3Aissue) and found no similar issues.
   
   
   ### What happened
   
   When calling GET /blueprints/{blueprintId} access tokens are correctly masked for gitextractor GitLab connections. When calling GET /projects/{projectName} the token is not masked in the Blueprint response. 
   
   ### What do you expect to happen
   
   The token to be masked in the response from GET /projects/{projectName}
   
   ### How to reproduce
   
   - Add a project with a GitLab connection
   - Retrieve the project from the API
   
   ### Anything else
   
   _No response_
   
   ### Version
   
   v0.21.0
   
   ### Are you willing to submit PR?
   
   - [ ] Yes I am willing to submit a PR!
   
   ### Code of Conduct
   
   - [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@devlake.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug][API] GET /projects exposes GitLab token in the gitextractor plugin [incubator-devlake]

["abeizn (via GitHub)" <gi...@apache.org>]

abeizn closed issue #7597: [Bug][API] GET /projects exposes GitLab token in the gitextractor plugin
URL: https://github.com/apache/incubator-devlake/issues/7597


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@devlake.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug][API] GET /projects exposes GitLab token in the gitextractor plugi [incubator-devlake]

["dosubot[bot] (via GitHub)" <gi...@apache.org>]

dosubot[bot] commented on issue #7597:
URL: https://github.com/apache/incubator-devlake/issues/7597#issuecomment-2155167112

   <!-- Greeting -->
   Hey there, @richard-fletcher! 👋 I'm here to help you with bugs, questions, and becoming a contributor. I'm a bot, but I can assist while you wait for a human maintainer.
   
   <!-- Answer -->
   To ensure that the GitLab token is masked in the response from the `GET /projects/{projectName}` endpoint, you can use the `Sanitize` method defined in the `GitlabConn` and `GitlabConnection` structs. This method replaces the token with a sanitized version.
   
   Here is the relevant code snippet that shows how the `Sanitize` method is used:
   
   ```go
   func (conn *GitlabConn) Sanitize() GitlabConn {
       conn.Token = utils.SanitizeString(conn.Token)
       return *conn
   }
   
   func (connection GitlabConnection) Sanitize() GitlabConnection {
       connection.GitlabConn = connection.GitlabConn.Sanitize()
       return connection
   }
   ```
   
   To ensure the token is masked in the response, you should call the `Sanitize` method on the `GitlabConnection` object before returning it in the response of the `GET /projects/{projectName}` endpoint. Here is an example of how you might do this:
   
   ```go
   func GetProjectHandler(w http.ResponseWriter, r *http.Request) {
       // Assume you have a function to get the GitlabConnection object
       connection := getGitlabConnectionFromRequest(r)
   
       // Sanitize the connection to mask the token
       sanitizedConnection := connection.Sanitize()
   
       // Return the sanitized connection in the response
       json.NewEncoder(w).Encode(sanitizedConnection)
   }
   ```
   
   This ensures that the token is masked in the response, protecting sensitive information <sup>[[1]](https://github.com/apache/incubator-devlake/blob/main/backend/plugins/gitlab/models/connection.go)</sup>.
   
   
   <!-- Dosu Comment Footer -->
   *To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@devlake.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org