Description of problem:
Callback plugins should use the CallbackBase._dump_results() method for no_log to take effect (and not just use raw results).
However, there are two lines in:
/usr/share/openstack-tripleo-validations/validations/callback_plugins/validation_output.py
which use raw results, and which could be an issue if those results are expected to hold secrets.
def v2_runner_on_ok
results = result._result # A dict of the module name etc.
def v2_runner_on_failed
result_dict = result._result # A dict of the module name etc.
Unless results in these two lines are expected to hold secrets, this should just be a hardening bug.
Version-Release number of selected component (if applicable):
openstack-tripleo-validations-5.5.0-2.el7ost
Expected results:
Should do something like: self._dump_results(result._result)
Description of problem: Callback plugins should use the CallbackBase._dump_results() method for no_log to take effect (and not just use raw results). However, there are two lines in: /usr/share/openstack-tripleo-validations/validations/callback_plugins/validation_output.py which use raw results, and which could be an issue if those results are expected to hold secrets. def v2_runner_on_ok results = result._result # A dict of the module name etc. def v2_runner_on_failed result_dict = result._result # A dict of the module name etc. Unless results in these two lines are expected to hold secrets, this should just be a hardening bug. Version-Release number of selected component (if applicable): openstack-tripleo-validations-5.5.0-2.el7ost Expected results: Should do something like: self._dump_results(result._result)