feat: mask SecretId / SecretKey / Token in list and get output#123
Open
Mxiansen wants to merge 3 commits into
Open
feat: mask SecretId / SecretKey / Token in list and get output#123Mxiansen wants to merge 3 commits into
Mxiansen wants to merge 3 commits into
Conversation
在 tccli configure list 与 tccli configure get 命令输出中对 secretId 和 secretKey 做脱敏，避免在 AI Agent 等场景直接打印凭证原文导致泄漏。 - 在 BasicConfigure 中新增 sensitive_keys 集合与 _mask_value 静态方法， 沿用项目已有 '*' + value[-4:] 的脱敏样式。 - ConfigureListCommand._run_main 输出敏感字段前套用 _mask_value， token / role-arn 等非密钥字段保持明文。 - ConfigureGetCommand._run_main 增加 from_cred 标志，仅当命中 credential 文件且字段属于 sensitive_keys 时脱敏， conf 分支与 kv 解析分支行为不变。 - 同步更新 ConfigureListCommand.EXAMPLES 与 ConfigureGetCommand.EXAMPLES， 演示脱敏后的输出形态。 - 磁盘上的 credential 文件内容保持原样，不影响后续鉴权调用。 Related TAPD: https://tapd.woa.com/tapd_fe/10161711/story/detail/1010161711135046182
Mxiansen
changed the title
…ace/curr_project/tencentcloud-cli && python3 -m pytest tests/test_command.py::test_G4_unfold_depth_31_rejected -q 2>&1 | tail -40 - 将 _mask_value 静态方法替换为模块级 mask_secret 函数 - 新实现采用等长 * + 末4位格式（更安全） - 支持长度 <= 4 的短值全部脱敏 - 将 sensitive_keys 重命名为 sensitive_cred_fields 并扩展为 set - 新增 token 字段的脱敏支持 - configure get 命令：无论字段来源均对敏感字段脱敏
Mxiansen
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Optimization
sensitive_keysset and_mask_valuestatic method toBasicConfigure, following the existing masking style'*' + value[-4:].ConfigureListCommand._run_mainto apply_mask_valuewhen printing sensitive fields; non-secret fields such astoken/role-arnremain in plaintext.ConfigureGetCommand._run_mainwith afrom_credflag, masking only when the field is read from the credential file and belongs tosensitive_keys; theconfbranch and kv-parsing branch are unchanged.ConfigureListCommand.EXAMPLESandConfigureGetCommand.EXAMPLESto demonstrate masked output.