marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 04:29:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

search executor: name the credential-like variables it refuses (names only)

Browse Source 
Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-05 17:36:12 +02:00
co-authored by Claude Opus 5.5
parent 1bfb729422
commit 75f2134eb4
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/search/executor.py
+7 -4
View File
@@ -534,11 +534,14 @@ def main() -> None:
prepared_url = os.environ.get("PREPARED_PUT_URL") prepared_url = os.environ.get("PREPARED_PUT_URL")
# Clearing Python's environment cannot remove initial /proc/self/environ. # Clearing Python's environment cannot remove initial /proc/self/environ.
# Refuse a misconfigured task before any repository input is opened. # Refuse a misconfigured task before any repository input is opened.
if any( inherited = sorted(
value and any(word in key.upper() for word in ("KEY", "TOKEN", "SECRET", "PASSWORD", "CREDENTIAL")) key
for key, value in os.environ.items() for key, value in os.environ.items()
): if value and any(word in key.upper() for word in ("KEY", "TOKEN", "SECRET", "PASSWORD", "CREDENTIAL"))
raise SystemExit("executor refuses inherited credentials") )
if inherited:
# Names only, never values, so a misconfigured task can be diagnosed from the worker log.
raise SystemExit("executor refuses inherited credentials: " + ", ".join(inherited))
scratch_limit = task_storage.configure() scratch_limit = task_storage.configure()
os.environ.clear() os.environ.clear()
os.environ.update(clean_environment()) os.environ.update(clean_environment())