Limit env variables propagated #13922

blindpirate · 2020-07-24T12:32:08Z

No description provided.

blindpirate · 2020-07-24T12:32:32Z

@bot-gradle test QF

bot-gradle · 2020-07-24T12:32:36Z

OK, I've already triggered QuickFeedback build for you.

blindpirate · 2020-07-24T12:35:17Z

@bot-gradle test QF

bot-gradle · 2020-07-24T12:35:19Z

Sorry some internal error occurs, please contact the administrator @blindpirate

bot-gradle · 2020-07-24T12:35:21Z

OK, I've already cancelled the old build and triggered a new QuickFeedback build for you.

buildSrc/subprojects/jvm/src/main/kotlin/gradlebuild/propagated-env-variables.kt

blindpirate · 2020-07-27T02:00:02Z

@bot-gradle test QF

bot-gradle · 2020-07-27T02:00:05Z

OK, I've already triggered QuickFeedback build for you.

blindpirate · 2020-07-27T02:11:35Z

@bot-gradle test QF

bot-gradle · 2020-07-27T02:11:39Z

OK, I've already cancelled the old build and triggered a new QuickFeedback build for you.

buildSrc/subprojects/jvm/src/main/kotlin/gradlebuild/propagated-env-variables.kt

blindpirate · 2020-07-27T09:58:15Z

@bot-gradle test RFN

bot-gradle · 2020-07-27T09:58:23Z

OK, I've already triggered ReadyForNightly build for you.

big-guy · 2020-07-27T12:52:08Z

buildSrc/subprojects/jvm/src/main/kotlin/gradlebuild/propagated-env-variables.kt

+
+fun Test.configurePropagatedEnvVariables() {
+    if (BuildEnvironment.isCiServer) {
+        environment = System.getenv().entries.mapNotNull(::sanitize).toMap()


Can we also have something that looks at the propagated environment variables and does a sanity check for "bad words"?

e.g., things like BUILD_CACHE_PASSWORD and TEAMCITY_TOKEN would make it through our filter, so I think we should make it so the build fails at this point if any env var contains (case insensitive) "password" or "token" so we're forced to pick a different name.

The failures at the test level below are OK, but it's too late at that point.

A few candidates to blacklist:

apikey

secret

auth

credential

buildSrc/subprojects/jvm/src/main/kotlin/gradlebuild/propagated-env-variables.kt

donat · 2020-07-27T15:21:51Z

buildSrc/subprojects/jvm/src/main/kotlin/gradlebuild/propagated-env-variables.kt

+
+
+fun Test.configurePropagatedEnvVariables() {
+    if (BuildEnvironment.isCiServer) {


❌ Local builds might also leak credentials. I think we should filter env vars for all builds.

blindpirate · 2020-07-28T06:37:40Z

@bot-gradle test RFN

bot-gradle · 2020-07-28T06:37:48Z

OK, I've already triggered ReadyForNightly build for you.

blindpirate · 2020-07-28T14:54:37Z

@bot-gradle test RFN

bot-gradle · 2020-07-28T14:54:45Z

OK, I've already triggered ReadyForNightly build for you.

blindpirate · 2020-07-29T00:17:51Z

Now finally it passes all check, anyone wanna take an another look?

buildSrc/subprojects/jvm/src/main/kotlin/gradlebuild/propagated-env-variables.kt

buildSrc/subprojects/jvm/src/main/kotlin/gradlebuild/unittest-and-compile.gradle.kts

blindpirate · 2020-07-29T07:11:09Z

@bot-gradle test RFN

bot-gradle · 2020-07-29T07:11:16Z

OK, I've already triggered ReadyForNightly build for you.

wolfs

I think we shouldn't pass BUILD_ to the test JVM, since I don't need that variable on my machine either. Apart from that the PR looks good now.

wolfs

LGTM!

wolfs · 2020-07-29T08:10:33Z

We fork some more processes from the build of gradle/gradle, for example to run git or to dump stacktraces. Shall we review those as well?

blindpirate · 2020-07-29T08:12:55Z

@wolfs you mean javaexec like ktlint right?

wolfs · 2020-07-29T08:14:56Z

@wolfs you mean javaexec like ktlint right?

I think exec and javaexec. We should only check what we use there, there is probably no need to do anything. And that is some follow up work.

wolfs · 2020-07-29T08:21:11Z

As another follow up, we should probably convert this new code into a plugin and use it on the other public projects as well. It could be part of the GE conventions plugin.

…d-env-variables.kt Co-authored-by: Stefan Wolf <[email protected]>

Limit environment variables propagated to test JVMs to avoid leaking credentials

donat · 2020-07-31T13:39:21Z

Cherry-picked to release.

* origin/release: Update to 6.6 RC5 Fix ktlint in Kotlin DSL Only use e.grdev.net for test distribution builds Upgrade conventions plugin to 0.7.1 Fix build logic instrumentation when a static interface method creates an instance of a serializable lambda. Limit env variables propagated (#13922) Merge pull request #13904 from gradle/blindpirate/remove-cmd-line-args-in-bat

blindpirate added the from:member label Jul 24, 2020

blindpirate force-pushed the blindpirate/limit-env-variables branch from 5abd10c to bf2bd3e Compare July 24, 2020 12:35

wolfs reviewed Jul 24, 2020

View reviewed changes

blindpirate force-pushed the blindpirate/limit-env-variables branch from bf2bd3e to 8f44394 Compare July 27, 2020 01:59

blindpirate force-pushed the blindpirate/limit-env-variables branch from 8f44394 to 9995e10 Compare July 27, 2020 02:11

blindpirate force-pushed the blindpirate/limit-env-variables branch 6 times, most recently from 7ed8b95 to 7cbcc1a Compare July 27, 2020 07:30

wolfs requested changes Jul 27, 2020

View reviewed changes

buildSrc/subprojects/jvm/src/main/kotlin/gradlebuild/propagated-env-variables.kt Outdated Show resolved Hide resolved

buildSrc/subprojects/jvm/src/main/kotlin/gradlebuild/propagated-env-variables.kt Outdated Show resolved Hide resolved

blindpirate force-pushed the blindpirate/limit-env-variables branch 2 times, most recently from 32cf9d1 to 2e65f1f Compare July 27, 2020 09:55

blindpirate marked this pull request as ready for review July 27, 2020 09:58

big-guy requested changes Jul 27, 2020

View reviewed changes

big-guy requested a review from donat July 27, 2020 12:54

big-guy reviewed Jul 27, 2020

View reviewed changes

buildSrc/subprojects/jvm/src/main/kotlin/gradlebuild/propagated-env-variables.kt Outdated Show resolved Hide resolved

donat reviewed Jul 27, 2020

View reviewed changes

blindpirate force-pushed the blindpirate/limit-env-variables branch 2 times, most recently from fea444e to 47f2b60 Compare July 28, 2020 14:54

wolfs requested changes Jul 29, 2020

View reviewed changes

blindpirate force-pushed the blindpirate/limit-env-variables branch from 2a25f70 to 5ada5ad Compare July 29, 2020 07:21

wolfs reviewed Jul 29, 2020

View reviewed changes

wolfs approved these changes Jul 29, 2020

View reviewed changes

blindpirate and others added 7 commits July 29, 2020 20:32

Limit propagated env variables

7284796

Filter sensitive data for local build

bea85f6

Update buildSrc/subprojects/jvm/src/main/kotlin/gradlebuild/propagate…

78d49e9

…d-env-variables.kt Co-authored-by: Stefan Wolf <[email protected]>

Update buildSrc/subprojects/jvm/src/main/kotlin/gradlebuild/propagate…

7f155a1

…d-env-variables.kt Co-authored-by: Stefan Wolf <[email protected]>

Resolve review feedback

834bf46

Remove BUILD_

5b49b5d

Remove value

78cfa12

blindpirate force-pushed the blindpirate/limit-env-variables branch from bdfac88 to 78cfa12 Compare July 29, 2020 12:33

blindpirate merged commit f30b025 into master Jul 30, 2020

blindpirate deleted the blindpirate/limit-env-variables branch July 30, 2020 03:42

donat pushed a commit that referenced this pull request Jul 31, 2020

Limit env variables propagated (#13922)

99a9147

Limit environment variables propagated to test JVMs to avoid leaking credentials



		fun Test.configurePropagatedEnvVariables() {
		if (BuildEnvironment.isCiServer) {

Limit env variables propagated #13922

Limit env variables propagated #13922

Uh oh!

Conversation

blindpirate commented Jul 24, 2020

Uh oh!

blindpirate commented Jul 24, 2020

Uh oh!

bot-gradle commented Jul 24, 2020

Uh oh!

blindpirate commented Jul 24, 2020

Uh oh!

bot-gradle commented Jul 24, 2020

Uh oh!

bot-gradle commented Jul 24, 2020

Uh oh!

Uh oh!

Uh oh!

Uh oh!

blindpirate commented Jul 27, 2020

Uh oh!

bot-gradle commented Jul 27, 2020

Uh oh!

blindpirate commented Jul 27, 2020

Uh oh!

bot-gradle commented Jul 27, 2020

Uh oh!

Uh oh!

Uh oh!

blindpirate commented Jul 27, 2020

Uh oh!

bot-gradle commented Jul 27, 2020

Uh oh!

big-guy Jul 27, 2020

Choose a reason for hiding this comment

Uh oh!

donat Jul 27, 2020

Choose a reason for hiding this comment

Uh oh!

Uh oh!

donat Jul 27, 2020

Choose a reason for hiding this comment

Uh oh!

blindpirate commented Jul 28, 2020

Uh oh!

bot-gradle commented Jul 28, 2020

Uh oh!

blindpirate commented Jul 28, 2020

Uh oh!

bot-gradle commented Jul 28, 2020

Uh oh!

blindpirate commented Jul 29, 2020

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

blindpirate commented Jul 29, 2020

Uh oh!

bot-gradle commented Jul 29, 2020

Uh oh!

wolfs left a comment

Choose a reason for hiding this comment

Uh oh!

wolfs left a comment

Choose a reason for hiding this comment

Uh oh!

wolfs commented Jul 29, 2020

Uh oh!

blindpirate commented Jul 29, 2020

Uh oh!

wolfs commented Jul 29, 2020

Uh oh!

wolfs commented Jul 29, 2020

Uh oh!

donat commented Jul 31, 2020

Uh oh!

Reviewers