From b78d922f0add37ef27a5817e9567b7cba1b8a53b Mon Sep 17 00:00:00 2001 From: Jan Lindemann Date: Sun, 16 Aug 2026 07:00:52 +0200 Subject: [PATCH] lib.ec.ssh.AsyncSSH: Actually hide password _connect_kwargs(hide_secrets = True) is used to log the connection parameters when a connection fails, without leaking the password. The filtered dictionary is built before the password is replaced with '', and the replacement is applied to the local kwargs dictionary afterwards, after the filtered copy has already been made. The dictionary that ends up in the log therefore still contains the real password. Hide the password before building the filtered dictionary. Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v0.84.2 Signed-off-by: Jan Lindemann --- src/python/jw/pkg/lib/ec/ssh/AsyncSSH.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/python/jw/pkg/lib/ec/ssh/AsyncSSH.py b/src/python/jw/pkg/lib/ec/ssh/AsyncSSH.py index a6ce7af5..cd7d53d6 100644 --- a/src/python/jw/pkg/lib/ec/ssh/AsyncSSH.py +++ b/src/python/jw/pkg/lib/ec/ssh/AsyncSSH.py @@ -72,10 +72,9 @@ class AsyncSSH(Base): } if self.__known_hosts is not _USE_DEFAULT_KNOWN_HOSTS: kwargs['known_hosts'] = self.__known_hosts - ret = {k: v for k, v in kwargs.items() if v is not None} if hide_secrets and 'password' in kwargs: kwargs['password'] = '' - return ret + return {k: v for k, v in kwargs.items() if v is not None} @property async def _conn(self) -> asyncssh.SSHClientConnection: