janware/jw-pkg
Watch
1
Code Pull requests Activity Actions

lib.ec.ssh.AsyncSSH: Actually hide password

Browse source 
_connect_kwargs(hide_secrets = True) is used to log the connection
parameters when a connection fails, without leaking the password. The
filtered dictionary is built before the password is replaced with
'<hidden>', and the replacement is applied to the local kwargs
dictionary afterwards, after the filtered copy has already been made.
The dictionary that ends up in the log therefore still contains the
real password.

Hide the password before building the filtered dictionary.

Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v0.84.2
Signed-off-by: Jan Lindemann <jan@janware.com>
This commit is contained in:
Jan Lindemann 2026-08-16 07:00:52 +02:00
commit b78d922f0a
Signed by: Jan Lindemann
GPG key ID: 3750640C9E25DD61
1 changed files with 1 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/python/jw/pkg/lib/ec/ssh/AsyncSSH.py
View file

@ -72,10 +72,9 @@ class AsyncSSH(Base):
} }
if self.__known_hosts is not _USE_DEFAULT_KNOWN_HOSTS: if self.__known_hosts is not _USE_DEFAULT_KNOWN_HOSTS:
kwargs['known_hosts'] = self.__known_hosts kwargs['known_hosts'] = self.__known_hosts
ret = {k: v for k, v in kwargs.items() if v is not None}
if hide_secrets and 'password' in kwargs: if hide_secrets and 'password' in kwargs:
kwargs['password'] = '<hidden>' kwargs['password'] = '<hidden>'
return ret return {k: v for k, v in kwargs.items() if v is not None}
@property @property
async def _conn(self) -> asyncssh.SSHClientConnection: async def _conn(self) -> asyncssh.SSHClientConnection: