Repository navigation
Conversation
Bitween masks only the properties an adapter declares private, and the flag needs SDK 6.0.x.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (22)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details🔇 Additional comments (21)
📝 SummarySummary
Riskrisk:medium — The change affects how credentials appear and persist in configuration UIs, and it upgrades the SDK used by affected adapters. Security-sensitive areasCredential masking and storage behavior. The change does not mark HTTP Test coverage impactThe PR description reports a successful build. It also reports four HTTP unit test failures caused by calls to external URLs; these are said to match failures on Operational concernsThe PR description says affected adapters are not published automatically. Publish each adapter and upload it to the deployment manually. The description reports that existing subscriptions continue to work after upgrade and that UI saves preserve stored passwords, but these behaviors were not independently verified here. WalkthroughOutbound handlers and receivers update credential expectation arguments. Several adapter projects add or update their ChangesCredential expectation updates
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~10 minutes Change: Bug fix Suggested labels: Suggested reviewers: Merge Risk: ⚪ Minimal · up to The reviewed receiver credentials remain required and private. No concrete merge-blocking issue is established; HTTP Headers redaction could not be confirmed for the pinned SDK. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 16 functions across 14 files. (8 skipped: 8 unsupported.)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
2 participants
Bitween hides a subscription's adapter settings only when the adapter marks them private. These adapters didn't mark any, so opening a subscription returned passwords, API keys and connection strings in plain text to anyone who can view subscriptions. This came up in a client penetration test.
ApiKey,Password,ClientSecret,ConnectionString,SecretAccessKeyandLicenseKey.Not marked: the HTTP
Headerssetting, which can carry tokens but would be hidden as a whole, and the MS Teams webhookUrl.Tested on a local Bitween with the HTTP handler. On the old version, opening the subscription returned the password. On the new version it returns
__private__. Saving from the UI keeps the stored password. Replacing it in the UI stores and uses the new one. A subscription created on the old version keeps working after the upgrade. The solution builds. The HTTP unit tests fail the same 4 tests as onnet6, because they call external URLs.Deploying: nothing publishes these adapters automatically. Each one has to be published and uploaded to a deployment by hand.