janware/jw-pkg
Watch
1
Code Pull requests Activity Actions

lib.ec.ssh.AsyncSSH: Actually hide password #87

Merged
Jan Lindemann merged 1 commit from jan/fix/20260905-lib-ec-ssh-asyncssh-actually-hide-password into master 2026-09-05 21:02:15 +02:00 AGit
Conversation 0 Commits 1 Files changed 1 +1 -2
Jan Lindemann commented 2026-09-05 20:53:34 +02:00
Owner
Copy link

lib.ec.ssh.AsyncSSH: Actually hide password

_connect_kwargs(hide_secrets = True) is used to log the connection parameters when a connection fails, without leaking the password. The filtered dictionary is built before the password is replaced with '', and the replacement is applied to the local kwargs dictionary afterwards, after the filtered copy has already been made. The dictionary that ends up in the log therefore still contains the real password.

Hide the password before building the filtered dictionary.

#### lib.ec.ssh.AsyncSSH: Actually hide password _connect_kwargs(hide_secrets = True) is used to log the connection parameters when a connection fails, without leaking the password. The filtered dictionary is built before the password is replaced with '<hidden>', and the replacement is applied to the local kwargs dictionary afterwards, after the filtered copy has already been made. The dictionary that ends up in the log therefore still contains the real password. Hide the password before building the filtered dictionary.
lib.ec.ssh.AsyncSSH: Actually hide password
All checks were successful
CI / Packaging - Kali Linux (pull_request) Successful in 4m18s
Details
CI / Packaging - OpenSUSE Tumbleweed (pull_request) Successful in 4m20s
Details
CI / Packaging test (pull_request) Successful in 0s
Details
CI / Packaging - Kali Linux (push) Successful in 3m50s
Details
CI / Packaging - OpenSUSE Tumbleweed (push) Successful in 4m20s
Details
CI / Packaging test (push) Successful in 0s
Details
994c264689
 
_connect_kwargs(hide_secrets = True) is used to log the connection
parameters when a connection fails, without leaking the password. The
filtered dictionary is built before the password is replaced with
'<hidden>', and the replacement is applied to the local kwargs
dictionary afterwards, after the filtered copy has already been made.
The dictionary that ends up in the log therefore still contains the
real password.

Hide the password before building the filtered dictionary.

Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v0.84.2
Signed-off-by: Jan Lindemann <jan@janware.com>
Jan Lindemann scheduled this pull request to auto merge when all checks succeed 2026-09-05 20:53:35 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
janware/jw-pkg!87
No description provided.