From 75f2134eb4a236c56aacfbc72f6b16d62d797f69 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Mon, 5 Oct 2026 17:36:12 +0200 Subject: [PATCH] search executor: name the credential-like variables it refuses (names only) Co-Authored-By: Claude Opus 5.5 --- src/openultrasast/search/executor.py | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/openultrasast/search/executor.py b/src/openultrasast/search/executor.py index bd26624..ba4d4d2 100644 --- a/src/openultrasast/search/executor.py +++ b/src/openultrasast/search/executor.py @@ -534,11 +534,14 @@ def main() -> None: prepared_url = os.environ.get("PREPARED_PUT_URL") # Clearing Python's environment cannot remove initial /proc/self/environ. # Refuse a misconfigured task before any repository input is opened. - if any( - value and any(word in key.upper() for word in ("KEY", "TOKEN", "SECRET", "PASSWORD", "CREDENTIAL")) + inherited = sorted( + key for key, value in os.environ.items() - ): - raise SystemExit("executor refuses inherited credentials") + if value and any(word in key.upper() for word in ("KEY", "TOKEN", "SECRET", "PASSWORD", "CREDENTIAL")) + ) + if inherited: + # Names only, never values, so a misconfigured task can be diagnosed from the worker log. + raise SystemExit("executor refuses inherited credentials: " + ", ".join(inherited)) scratch_limit = task_storage.configure() os.environ.clear() os.environ.update(clean_environment())