fix(support): sanitize agent env

johnstcn · johnstcn · commit 001450dcb423 · 2024-03-12T14:11:02.000Z
diff --git a/coderd/database/dbfake/dbfake.go b/coderd/database/dbfake/dbfake.go
@@ -95,6 +95,9 @@ func (b WorkspaceBuildBuilder) WithAgent(mutations ...func([]*sdkproto.Agent) []
 		Auth: &sdkproto.Agent_Token{
 			Token: b.agentToken,
 		},
+		Env: map[string]string{
+			"SECRET_TOKEN": "supersecret",
+		},
 	}}
 	for _, m := range mutations {
 		agents = m(agents)
diff --git a/support/support.go b/support/support.go
@@ -191,6 +191,11 @@ func WorkspaceInfo(ctx context.Context, client *codersdk.Client, log slog.Logger
 		log.Error(ctx, "fetch workspace", slog.Error(err), slog.F("workspace_id", workspaceID))
 		return w
 	}
+	for _, res := range ws.LatestBuild.Resources {
+		for _, agt := range res.Agents {
+			sanitizeEnv(agt.EnvironmentVariables)
+		}
+	}
 	w.Workspace = ws
 
 	eg.Go(func() error {
@@ -346,3 +351,14 @@ func Run(ctx context.Context, d *Deps) (*Bundle, error) {
 
 	return &b, nil
 }
+
+// sanitizeEnv modifies kvs in place and erases the values of keys containing
+// the strings "secret", "token", or "pass"
+func sanitizeEnv(kvs map[string]string) {
+	for k := range kvs {
+		kl := strings.ToLower(k)
+		if strings.Contains(kl, "secret") || strings.Contains(kl, "token") || strings.Contains(kl, "pass") {
+			kvs[k] = ""
+		}
+	}
+}
diff --git a/support/support_test.go b/support/support_test.go
@@ -5,6 +5,7 @@ import (
 	"context"
 	"io"
 	"net/http"
+	"strings"
 	"testing"
 	"time"
 
@@ -57,6 +58,7 @@ func TestRun(t *testing.T) {
 		require.NotEmpty(t, bun.Network.TailnetDebug)
 		require.NotNil(t, bun.Network.NetcheckLocal)
 		require.NotNil(t, bun.Workspace.Workspace)
+		assertSanitizedWorkspace(t, bun.Workspace.Workspace)
 		require.NotEmpty(t, bun.Workspace.BuildLogs)
 		require.NotNil(t, bun.Workspace.Agent)
 		require.NotEmpty(t, bun.Workspace.AgentStartupLogs)
@@ -92,6 +94,7 @@ func TestRun(t *testing.T) {
 		require.NotEmpty(t, bun.Network.CoordinatorDebug)
 		require.NotEmpty(t, bun.Network.TailnetDebug)
 		require.NotNil(t, bun.Workspace)
+		assertSanitizedWorkspace(t, bun.Workspace.Workspace)
 		require.NotEmpty(t, bun.Logs)
 	})
 
@@ -140,6 +143,20 @@ func assertSanitizedDeploymentConfig(t *testing.T, dc *codersdk.DeploymentConfig
 	}
 }
 
+func assertSanitizedWorkspace(t *testing.T, ws codersdk.Workspace) {
+	t.Helper()
+	for _, res := range ws.LatestBuild.Resources {
+		for _, agt := range res.Agents {
+			for k, v := range agt.EnvironmentVariables {
+				kl := strings.ToLower(k)
+				if strings.Contains(kl, "secret") || strings.Contains(kl, "token") || strings.Contains(kl, "pass") {
+					assert.Empty(t, v, "environment variable %q not sanitized", k)
+				}
+			}
+		}
+	}
+}
+
 func setupWorkspaceAndAgent(ctx context.Context, t *testing.T, client *codersdk.Client, db database.Store, user codersdk.CreateFirstUserResponse) (codersdk.Workspace, codersdk.WorkspaceAgent) {
 	// This is a valid zip file
 	zipBytes := make([]byte, 22)
