Skip to content

Kudu call to get app settings is logging secrets #45

@DanHamlin-LifeTime

Description

@DanHamlin-LifeTime

console.log(`##[debug]getAppSettings. Data: ${JSON.stringify(response)}`);

I just started working with github actions and noticed this call to getAppSettings is logging the response in its entirety into the actions console. This is exposing what would otherwise be secret app settings only accessible from the azure portal. In my particular deployment it is only using this call to warm up kudu before calling the zip deploy.

Could this be configured to be silent? Or is there a different call that could be used for warming up kudu? I notice this call is also used where appsettings are actually needed however it shouldn't log them by default in that case either.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions