User's password is exposed in UI for a build
プラットフォームについて: Data Center - この記事は、Data Center プラットフォームのアトラシアン製品に適用されます。
このナレッジベース記事は製品の Data Center バージョン用に作成されています。Data Center 固有ではない機能の Data Center ナレッジベースは、製品のサーバー バージョンでも動作する可能性はありますが、テストは行われていません。サーバー*製品のサポートは 2024 年 2 月 15 日に終了しました。サーバー製品を利用している場合は、アトラシアンのサーバー製品のサポート終了のお知らせページにて移行オプションをご確認ください。
*Fisheye および Crucible は除く
要約
Bamboo is showing password in Recent History view as "Changes By".
環境
All versions of Bamboo
診断
In this view the data is being populated from git. Use these commands to confirm the data is coming from git.
- Checkout the branch listed in in the build dashboard on any git clone.
- Get the hash of the commit. This can be done with git log.
- Print the raw commit message:
git cat-file -p <hash>
原因
When the commit was made, the data was passed as Author. Here is an example command:
git commit --author="Dave Laser <dlaser@atlassian.com>" -m "My alter ego Dave made this commit."ソリューション
This commit will need to be removed or recreated. To avoid this issue you just need to create a commit that does not have this password. Here are the possible resolutions:
- Change user name and password. Use committer data from commit to know who to contact to stop this behaviour.
- Delete the branch or branches with offending commit. This will remove the commit from being active.
- Deploy a git
pre-commitin Bitbucket to confirm the Committer and Author are the same.
Depending how much of your git repository has this commit will define how much action you need to take to resolve this issue. Removing or rewriting history for this tree is a viable solution but yet dangerous solution.