819361 - don't print csrf tokens in balrog client logs

Status: RESOLVED FIXED

(Release Engineering :: General, defect, P3)

Description

[[e-mail] (:bhearsum)]

Given that they are time based, this is a security issue.

Comment 1

[Nick Thomas [:nthomas] (UTC+12)]

Attachment: [tools] Eyeball fix

Comment 2

[[e-mail] (:bhearsum)]

Comment on attachment 756326 [details] [diff] [review]
[tools] Eyeball fix

Review of attachment 756326 [details] [diff] [review]:
-----------------------------------------------------------------

lgtm!

Comment 3

[Nick Thomas [:nthomas] (UTC+12)]

Comment on attachment 756326 [details] [diff] [review]
[tools] Eyeball fix

https://hg.mozilla.org/build/tools/rev/e7d01202e376

Comment 4

[[e-mail] (:bhearsum)]

Boo, this broke :(

Traceback (most recent call last):
  File "/builds/slave/m-aurora-lx-ntly-0000000000000/tools/scripts/updates/balrog-submitter.py", line 36, in <module>
    runner.run()
  File "/builds/slave/m-aurora-lx-ntly-0000000000000/tools/lib/python/balrog/submitter/cli.py", line 80, in run
    buildData=data, copyTo=copyTo)
  File "/builds/slave/m-aurora-lx-ntly-0000000000000/tools/lib/python/balrog/submitter/api.py", line 129, in update_build
    url_template_vars=url_template_vars)
  File "/builds/slave/m-aurora-lx-ntly-0000000000000/tools/lib/python/balrog/submitter/api.py", line 79, in request
    res = self.do_request(prerequest_url, None, 'HEAD', {})
  File "/builds/slave/m-aurora-lx-ntly-0000000000000/tools/lib/python/balrog/submitter/api.py", line 102, in do_request
    sanitised_data = data.copy()
AttributeError: 'NoneType' object has no attribute 'copy'

This is happening during the HEAD request where we get the token (https://github.com/mozilla/build-tools/blob/master/lib/python/balrog/submitter/api.py#L79)

Comment 5

[Nick Thomas [:nthomas] (UTC+12)]

Attachment: [tools] Fix

Comment 6

[Nick Thomas [:nthomas] (UTC+12)]

Comment on attachment 758242 [details] [diff] [review]
[tools] Fix

https://hg.mozilla.org/build/tools/rev/0f50bbd52b8d

Comment 7

[Nick Thomas [:nthomas] (UTC+12)]

Working now.