Otter is displaying a credential password in the execution log

markrobertjohnson

I am using the $GetCredentialProperty(cred,Password) to pass a password into a powershell script in a PSEnsure statement. The execution log renders all of the input parameters, including the password (as DEBUG log items). Is there a way to redact the the password? perhaps just turning off DEBUG log messages would be sufficient, but I do not know how to turn those DEBUG log messages off.

#PSEnsure Statement
PSEnsure
(
Key: ConfigureNpm,
Value: 0,
CollectScript: Test-DefaultNpmRegistry,
ConfigureScript: Set-NpmConfiguration,
UseExitCode: true,
CollectScriptParams: %(
RegistryUrl: "$DefaultNpmPullRegistryUrl"
),
ConfigureScriptParams: %(
RegistryUrl: $DefaultNpmPullRegistryUrl,
RegistryUsername: $GetCredentialProperty(devbuilder,Username),
RegistryPassword: $GetCredentialProperty(devbuilder,Password),
UserProfileName: $GetCredentialProperty(devbuilder,Username)
)
);

#Log Output
DEBUG: Found script Set-NpmConfiguration.ps1 in Default raft.
DEBUG: Assigning parameter RegistryUrl=http://proget.internal.com/npm/npm
DEBUG: Assigning parameter RegistryUsername=builderusername
DEBUG: Assigning parameter RegistryPassword=<PASSWORD_IS_RENDERED_HERE>
DEBUG: Assigning parameter UserProfileName=builderusername

Hmm, that doesn't make sense. I don't see a purpose to logging values, since you can just Log-Debug if there is a problem before runnign the script. Easy fix.

So, if you update to the latest Windows Extension (1.3.3), the logging should be changed to:

DEBUG: Found script Set-NpmConfiguration.ps1 in Default raft.
DEBUG: Assigning parameter RegistryUrl...
DEBUG: Assigning parameter RegistryUsername...
DEBUG: Assigning parameter RegistryPassword...
DEBUG: Assigning parameter UserProfileName...

Thanks Steve! That solved the issue.