Files
rclone/fs/configmap.go
Pastalikek65andNick Craig-Wood adc7f2ebfa config: redact env var config values in logs
Before this change the environment variable getters in fs/configmap.go
logged the option value with %q, so a password set via
RCLONE_CONFIG_remote_pass (or RCLONE_remote_pass) was printed in full
to the debug log. Values from the config file were already redacted,
which made the leak easy to miss.

This change routes both getters through fs.RedactOptionValue, which
looks up the option in the backend's option list: options marked
IsPassword or Sensitive log as XXX, unknown options are conservatively
redacted, and --dump auth still shows the value for debugging.

Fixes #5794
2026-08-13 20:10:41 +02:00

155 lines
4.6 KiB
Go

// Getters and Setters for ConfigMap
package fs
import (
"context"
"os"
"github.com/rclone/rclone/fs/config/configmap"
)
// A configmap.Getter to read from the environment RCLONE_CONFIG_backend_option_name
type configEnvVars struct {
configName string
options Options
}
// Get a config item from the environment variables if possible
func (c configEnvVars) Get(key string) (value string, ok bool) {
envKey := ConfigToEnv(c.configName, key)
value, ok = os.LookupEnv(envKey)
if ok {
opt := c.options.Get(key)
Debugf(nil, "Setting %s=%s for %q from environment variable %s", key, RedactOptionValue(GetConfig(context.Background()), opt, value), c.configName, envKey)
}
return value, ok
}
// A configmap.Getter to read from the environment RCLONE_option_name
type optionEnvVars struct {
prefix string
options Options
}
// Get a config item from the option environment variables if possible
func (oev optionEnvVars) Get(key string) (value string, ok bool) {
opt := oev.options.Get(key)
if opt == nil {
return "", false
}
var envKey string
if oev.prefix == "" {
envKey = OptionToEnv(key)
} else {
envKey = OptionToEnv(oev.prefix + "-" + key)
}
value, ok = os.LookupEnv(envKey)
if ok {
Debugf(nil, "Setting %s %s=%s from environment variable %s", oev.prefix, key, RedactOptionValue(GetConfig(context.Background()), opt, value), envKey)
} else if opt.NoPrefix {
// For options with NoPrefix set, check without prefix too
envKey := OptionToEnv(key)
value, ok = os.LookupEnv(envKey)
if ok {
Debugf(nil, "Setting %s=%s for %s from environment variable %s", key, RedactOptionValue(GetConfig(context.Background()), opt, value), oev.prefix, envKey)
}
}
return value, ok
}
// A configmap.Getter to read either the default value or the set
// value from the RegInfo.Options
type regInfoValues struct {
options Options
useDefault bool
}
// override the values in configMap with the either the flag values or
// the default values
func (r *regInfoValues) Get(key string) (value string, ok bool) {
opt := r.options.Get(key)
// Return the value if it was explicitly set (e.g. a flag on the
// command line, even when equal to the default) or if it differs
// from the default (e.g. loaded from the environment as a flag
// default by installFlag).
if opt != nil && (r.useDefault || opt.IsSet() || !opt.IsDefault()) {
return opt.String(), true
}
return "", false
}
// A configmap.Setter to read from the config file
type setConfigFile string
// Set a config item into the config file
func (section setConfigFile) Set(key, value string) {
Debugf(nil, "Saving config %q in section %q of the config file", key, section)
err := ConfigFileSet(string(section), key, value)
if err != nil {
Errorf(nil, "Failed saving config %q in section %q of the config file: %v", key, section, err)
}
}
// A configmap.Getter to read from the config file
type getConfigFile string
// Get a config item from the config file
func (section getConfigFile) Get(key string) (value string, ok bool) {
value, ok = ConfigFileGet(string(section), key)
// Ignore empty lines in the config file
if value == "" {
ok = false
}
return value, ok
}
// ConfigMap creates a configmap.Map from the Options, prefix and the
// configName passed in. If connectionStringConfig has any entries (it may be nil),
// then it will be added to the lookup with the highest priority.
//
// If options is nil then the returned configmap.Map should only be
// used for reading non backend specific parameters, such as "type".
//
// This can be used for global settings if prefix is "" and configName is ""
func ConfigMap(prefix string, options Options, configName string, connectionStringConfig configmap.Simple) (config *configmap.Map) {
// Create the config
config = configmap.New()
// Read the config, more specific to least specific
// Config from connection string
if len(connectionStringConfig) > 0 {
config.AddGetter(connectionStringConfig, configmap.PriorityNormal)
}
// flag values
if options != nil {
config.AddGetter(&regInfoValues{options, false}, configmap.PriorityNormal)
}
// remote specific environment vars
if configName != "" {
config.AddGetter(configEnvVars{configName: configName, options: options}, configmap.PriorityNormal)
}
// backend specific environment vars
if options != nil {
config.AddGetter(optionEnvVars{prefix: prefix, options: options}, configmap.PriorityNormal)
}
// config file
if configName != "" {
config.AddGetter(getConfigFile(configName), configmap.PriorityConfig)
}
// default values
if options != nil {
config.AddGetter(&regInfoValues{options, true}, configmap.PriorityDefault)
}
// Set Config
config.AddSetter(setConfigFile(configName))
return config
}