renovate/renovate
1
0
Fork 0
mirror of https://github.com/renovatebot/renovate.git synced 2025-01-12 06:56:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

logs: more details on secrets exposure

Browse source
This commit is contained in:
Rhys Arkins 2021-11-19 14:46:44 +01:00
parent ff7822176f
commit 42231b6b75
2 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/workers/branch/commit.ts
View file

@ -41,6 +41,10 @@ export function commitFilesToBranch(
config.branchName !== sanitize(config.branchName) ||
config.commitMessage !== sanitize(config.commitMessage)
) {
logger.debug(
{ branchName: config.branchName },
'Secrets exposed in branchName or commitMessage'
);
throw new Error(CONFIG_SECRETS_EXPOSED);
}
// API will know whether to create new branch or not

8
lib/workers/repository/updates/generate.ts
View file

@ -172,6 +172,10 @@ export function generateBranchConfig(
upgrade.commitMessage = template.compile(upgrade.commitMessage, upgrade);
// istanbul ignore if
if (upgrade.commitMessage !== sanitize(upgrade.commitMessage)) {
logger.debug(
{ branchName: config.branchName },
'Secrets exposed in commit message'
);
throw new Error(CONFIG_SECRETS_EXPOSED);
}
upgrade.commitMessage = upgrade.commitMessage.trim(); // Trim exterior whitespace
@ -202,6 +206,10 @@ export function generateBranchConfig(
.replace(regEx(/\s+/g), ' '); // TODO #12071
// istanbul ignore if
if (upgrade.prTitle !== sanitize(upgrade.prTitle)) {
logger.debug(
{ branchName: config.branchName },
'Secrets were exposed in PR title'
);
throw new Error(CONFIG_SECRETS_EXPOSED);
}
if (upgrade.toLowerCase) {