janware/jw-pkg
Watch
1
Code Pull requests Activity Actions

lib.ec.ssh.AsyncSSH: Actually hide password #87

Merged
Jan Lindemann merged 1 commit from jan/fix/20260905-lib-ec-ssh-asyncssh-actually-hide-password into master 2026-09-05 21:02:15 +02:00 AGit
Conversation 0 Commits 1 Files changed 1 +1 -2
1 changed files with 1 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 994c264689 - Show all commits

lib.ec.ssh.AsyncSSH: Actually hide password
All checks were successful
CI / Packaging - Kali Linux (pull_request) Successful in 4m18s
Details
CI / Packaging - OpenSUSE Tumbleweed (pull_request) Successful in 4m20s
Details
CI / Packaging test (pull_request) Successful in 0s
Details
CI / Packaging - Kali Linux (push) Successful in 3m50s
Details
CI / Packaging - OpenSUSE Tumbleweed (push) Successful in 4m20s
Details
CI / Packaging test (push) Successful in 0s
Details

Prev Next 
_connect_kwargs(hide_secrets = True) is used to log the connection
parameters when a connection fails, without leaking the password. The
filtered dictionary is built before the password is replaced with
'<hidden>', and the replacement is applied to the local kwargs
dictionary afterwards, after the filtered copy has already been made.
The dictionary that ends up in the log therefore still contains the
real password.

Hide the password before building the filtered dictionary.

Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v0.84.2
Signed-off-by: Jan Lindemann <jan@janware.com>
Jan Lindemann 2026-08-16 07:00:52 +02:00
commit 994c264689
Signed by: Jan Lindemann
GPG key ID: 3750640C9E25DD61

3
src/python/jw/pkg/lib/ec/ssh/AsyncSSH.py
View file

@ -72,10 +72,9 @@ class AsyncSSH(Base):
} }
if self.__known_hosts is not _USE_DEFAULT_KNOWN_HOSTS: if self.__known_hosts is not _USE_DEFAULT_KNOWN_HOSTS:
kwargs['known_hosts'] = self.__known_hosts kwargs['known_hosts'] = self.__known_hosts
ret = {k: v for k, v in kwargs.items() if v is not None}
if hide_secrets and 'password' in kwargs: if hide_secrets and 'password' in kwargs:
kwargs['password'] = '<hidden>' kwargs['password'] = '<hidden>'
return ret return {k: v for k, v in kwargs.items() if v is not None}
@property @property
async def _conn(self) -> asyncssh.SSHClientConnection: async def _conn(self) -> asyncssh.SSHClientConnection: