schemachange
schemachange copied to clipboard
Redact multiline secrets
Problem
When given a multi-line secret in the schemachange-config YAML, it would not be redacted, because just before calling SecretManager.global_redact
, the config vars section would be serialised as YAML, adding leading whitespaces to the multiline secret
Proposed solution Recurse over the config vars section, and redact all strings in it, and only then serialise as YAML. When redacting multiline secrets, preserve newlines.
Minor edits added in
- The method that was extracting secrets would crash if the value was of a type that did not have the
strip()
method. Added an explicit raise of a ValueError if a secret is not of typestr
- Added tests for added functionality
Notes For redacting in SQL queries nothing was changed, as indenting while rendering Jinja templates is under control of the user of schemachange.