From 1763064edcb25a37f7c51085bdd176b75d456f50 Mon Sep 17 00:00:00 2001 From: Al Bailey Date: Fri, 8 Jul 2022 18:36:57 +0000 Subject: [PATCH] Fix password masking by collect for gzipped files The zgrep syntax for a regex search was incorrect. The -E argument is required. This meant that if a gzipped file (ie: bash.log.gz) was included in a collect, then its passwords would not be redacted. Closes-Bug: 1981101 Test Plan: Verify that a gzipped bash log has its password redacted when running collect on CentOS and Debian. Signed-off-by: Al Bailey Change-Id: I497813949b65137a93a91bf58ede2c591fb15f62 --- tools/collector/debian-scripts/collect_mask_passwords | 2 +- tools/collector/scripts/collect_mask_passwords | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/collector/debian-scripts/collect_mask_passwords b/tools/collector/debian-scripts/collect_mask_passwords index a168564d..27b79df4 100644 --- a/tools/collector/debian-scripts/collect_mask_passwords +++ b/tools/collector/debian-scripts/collect_mask_passwords @@ -123,7 +123,7 @@ for f in ${COLLECT_NAME_DIR}/var/log/bash.log.*.gz \ ${COLLECT_NAME_DIR}/var/log/user.log.*.gz \ ${COLLECT_NAME_DIR}/var/log/ldapscripts.log.*.gz do - zgrep -q 'snmp|password' $f || continue + zgrep -q -E 'snmp|password' $f || continue gunzip $f unzipped=${f%%.gz} sed -i -r 's/(snmp-comm-(delete|show)) *((\"[^\"]*\"|'\''[^'"'"']*'"'"'|[^ ]*) *){1,}/\1 xxxxxx/; diff --git a/tools/collector/scripts/collect_mask_passwords b/tools/collector/scripts/collect_mask_passwords index a168564d..27b79df4 100644 --- a/tools/collector/scripts/collect_mask_passwords +++ b/tools/collector/scripts/collect_mask_passwords @@ -123,7 +123,7 @@ for f in ${COLLECT_NAME_DIR}/var/log/bash.log.*.gz \ ${COLLECT_NAME_DIR}/var/log/user.log.*.gz \ ${COLLECT_NAME_DIR}/var/log/ldapscripts.log.*.gz do - zgrep -q 'snmp|password' $f || continue + zgrep -q -E 'snmp|password' $f || continue gunzip $f unzipped=${f%%.gz} sed -i -r 's/(snmp-comm-(delete|show)) *((\"[^\"]*\"|'\''[^'"'"']*'"'"'|[^ ]*) *){1,}/\1 xxxxxx/;