Ayush KumarandGitHub 5d19a031fa Fix: do not log or persist credentials embedded in Terraform module remote URLs (#7201) ...

The remote URL of a Terraform module can embed credentials (for example
https://user:token@host/repo.git). The cache-reuse logic logged the raw URL
and wrote it to the .remote-url cache marker, which could leak those
credentials into controller logs and onto disk.

Strip the userinfo from the URL before logging it and before writing the cache
marker. The marker now stores a credential-free URL and the reuse check
compares the same stripped form, so cache reuse and re-clone-on-change behave
as before while no secret is persisted.

Signed-off-by: Ayush Kumar <65535504+roguepikachu@users.noreply.github.com>

2026-06-25 09:52:44 +01:00

..

common

Chore: remove outdated apis(v1alppha2 ApplicationConfiguration Component, and HealthScope, Rollout) (#6041)

2023-06-01 09:32:49 +08:00

core.oam.dev

Fix(controller): set Ready condition to False on reconcile failure (#7168)

2026-06-03 07:36:33 -07:00

utils

Fix: do not log or persist credentials embedded in Terraform module remote URLs (#7201)

2026-06-25 09:52:44 +01:00

flags.go

Chore: remove outdated apis(v1alppha2 ApplicationConfiguration Component, and HealthScope, Rollout) (#6041)

2023-06-01 09:32:49 +08:00