Repository navigation
Redact environment secrets before writing or displaying diagnostic logs #3120
Description
Summary
The CMD, PowerShell and Bash diagnostic helpers print every environment variable and persist the results to temporary log files. These logs can include API tokens, cloud credentials, passwords and credential-bearing URLs.
Severity: Medium. Confidence: High for the unredacted logging behavior, confirmed by source inspection at commit 1d6777b5c087c7e31ab9b2a1237276c9fe8a0d3a. Actual disclosure depends on secrets being present and someone obtaining or sharing the output. No real credentials were collected and the diagnostic scripts were not executed during this audit.
Code path
- vendor/bin/cmder_diag.cmd:7: bare
set; the output is written to the temporary log at line 54 and displayed at line 56. - vendor/bin/cmder_diag.ps1:10:
Get-ChildItem env:; logged/displayed at lines 59–61. - vendor/bin/cmder_diag.sh:9:
env; logged/displayed at lines 56–58.
Scenario and impact
A developer runs a diagnostic from a shell containing deployment credentials and attaches the output to a support issue. The credentials are included verbatim. The existing instruction to sanitize output is helpful, but relies on the user finding every sensitive value; it does not prevent secrets from being written to disk first.
Recommended correction
Allowlist the environment variables needed for Cmder troubleshooting and redact sensitive values before either writing logs or displaying output. Avoid printing unknown environment values by default. Keep the sanitization warning as an additional precaution.
Validation to add
Use synthetic sentinel values only: place a fake API token, password and credential-bearing URL in an isolated test environment, run each helper, and assert that none of the sentinels appears in either output or the saved log. Confirm that the allowlisted Cmder diagnostics remain useful.
Existing issues checked
Searches of open and closed issues for cmder_diag, redaction, credentials and secrets found diagnostic troubleshooting threads, but no issue requesting prevention of environment-secret disclosure.
Activity