{"action":"created","issue":{"url":"https://api.github.com/repos/rundeck/rundeck/issues/1780","repository_url":"https://api.github.com/repos/rundeck/rundeck","labels_url":"https://api.github.com/repos/rundeck/rundeck/issues/1780/labels{/name}","comments_url":"https://api.github.com/repos/rundeck/rundeck/issues/1780/comments","events_url":"https://api.github.com/repos/rundeck/rundeck/issues/1780/events","html_url":"https://github.com/rundeck/rundeck/issues/1780","id":145776393,"number":1780,"title":"Masked Passwords are exposed if a job is run in debug mode","user":{"login":"anelson425","id":3718231,"avatar_url":"https://avatars2.githubusercontent.com/u/3718231?v=4","gravatar_id":"","url":"https://api.github.com/users/anelson425","html_url":"https://github.com/anelson425","followers_url":"https://api.github.com/users/anelson425/followers","following_url":"https://api.github.com/users/anelson425/following{/other_user}","gists_url":"https://api.github.com/users/anelson425/gists{/gist_id}","starred_url":"https://api.github.com/users/anelson425/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anelson425/subscriptions","organizations_url":"https://api.github.com/users/anelson425/orgs","repos_url":"https://api.github.com/users/anelson425/repos","events_url":"https://api.github.com/users/anelson425/events{/privacy}","received_events_url":"https://api.github.com/users/anelson425/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/rundeck/rundeck/milestones/56","html_url":"https://github.com/rundeck/rundeck/milestone/56","labels_url":"https://api.github.com/repos/rundeck/rundeck/milestones/56/labels","id":2486482,"number":56,"title":"2.9.0","description":"","creator":{"login":"gschueler","id":55603,"avatar_url":"https://avatars3.githubusercontent.com/u/55603?v=4","gravatar_id":"","url":"https://api.github.com/users/gschueler","html_url":"https://github.com/gschueler","followers_url":"https://api.github.com/users/gschueler/followers","following_url":"https://api.github.com/users/gschueler/following{/other_user}","gists_url":"https://api.github.com/users/gschueler/gists{/gist_id}","starred_url":"https://api.github.com/users/gschueler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gschueler/subscriptions","organizations_url":"https://api.github.com/users/gschueler/orgs","repos_url":"https://api.github.com/users/gschueler/repos","events_url":"https://api.github.com/users/gschueler/events{/privacy}","received_events_url":"https://api.github.com/users/gschueler/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":34,"state":"closed","created_at":"2017-04-27T16:34:26Z","updated_at":"2017-08-09T21:00:52Z","due_on":null,"closed_at":"2017-08-03T20:35:43Z"},"comments":11,"created_at":"2016-04-04T19:08:44Z","updated_at":"2017-10-14T13:24:09Z","closed_at":"2017-08-03T17:59:57Z","author_association":"NONE","body":"It looks like if you run a job in debug mode, masked passwords can be exposed on the console. This seems like somewhat of a security issue. I am curious as to whether this was intended functionality or not though.\n\nIf it wasn't, I would be more than happy to work on a code fix and issue a PR for it.\n"},"comment":{"url":"https://api.github.com/repos/rundeck/rundeck/issues/comments/336634775","html_url":"https://github.com/rundeck/rundeck/issues/1780#issuecomment-336634775","issue_url":"https://api.github.com/repos/rundeck/rundeck/issues/1780","id":336634775,"user":{"login":"niphlod","id":122119,"avatar_url":"https://avatars2.githubusercontent.com/u/122119?v=4","gravatar_id":"","url":"https://api.github.com/users/niphlod","html_url":"https://github.com/niphlod","followers_url":"https://api.github.com/users/niphlod/followers","following_url":"https://api.github.com/users/niphlod/following{/other_user}","gists_url":"https://api.github.com/users/niphlod/gists{/gist_id}","starred_url":"https://api.github.com/users/niphlod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/niphlod/subscriptions","organizations_url":"https://api.github.com/users/niphlod/orgs","repos_url":"https://api.github.com/users/niphlod/repos","events_url":"https://api.github.com/users/niphlod/events{/privacy}","received_events_url":"https://api.github.com/users/niphlod/received_events","type":"User","site_admin":false},"created_at":"2017-10-14T13:24:09Z","updated_at":"2017-10-14T13:24:09Z","author_association":"NONE","body":"I'm using ScriptPlugin mostly and if you enable the debug, you can see secure/masked bits in the internals logging of rundeck, as in a RemoteScriptNodeStep `\"launching path/to_script with args [-var MASKED ...]\"` . This was in 2.9.2 for sure, I'll update to 2.9.4 next week and I'll be able to provide a screenshot if needed."}}
{"actor":{"display_login":"niphlod"}}