starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-11-06 13:10:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(deployments): do not print build-time values in development debug lines

Browse Source 
With APP_ENV=local the deployment log showed every build-time value (raw,
stripped and escaped) and the old and new value of overrides. Print only the
key, the type and the value length.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Andras Bacsai
2026-09-28 11:42:03 +02:00
co-authored by Claude Opus 5.5
parent f540c49f68
commit f885e1eeeb
2 changed files with 28 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Jobs/ApplicationDeploymentJob.php
+9 -15
View File
@@ -1916,7 +1916,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
$envs_dict[$key] = $escapedValue;
if (isDev()) {
$this->application_deployment_queue->addLogEntry("[DEBUG] Nixpacks var: {$key}={$escapedValue}");
$this->application_deployment_queue->addLogEntry("[DEBUG] Nixpacks var: {$key}");
}
}
}
@@ -2015,7 +2015,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
$escapedValue = escapeBashEnvValue($value);
if (isDev() && isset($envs_dict[$env->key])) {
$this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (was: {$envs_dict[$env->key]}, now: {$escapedValue})");
$this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (value replaced)");
}
$envs_dict[$env->key] = $escapedValue;
@@ -2023,16 +2023,14 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
if (isDev()) {
$this->application_deployment_queue->addLogEntry("[DEBUG] Build-time env: {$env->key}");
$this->application_deployment_queue->addLogEntry('[DEBUG] Type: literal/multiline');
$this->application_deployment_queue->addLogEntry("[DEBUG] raw real_value: {$resolvedValue}");
$this->application_deployment_queue->addLogEntry("[DEBUG] stripped value: {$value}");
$this->application_deployment_queue->addLogEntry("[DEBUG] final escaped: {$escapedValue}");
$this->application_deployment_queue->addLogEntry('[DEBUG] Value length: '.strlen($escapedValue));
}
} else {
// For normal vars, use double quotes to allow $VAR expansion
$escapedValue = escapeBashDoubleQuoted($resolvedValue);
if (isDev() && isset($envs_dict[$env->key])) {
$this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (was: {$envs_dict[$env->key]}, now: {$escapedValue})");
$this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (value replaced)");
}
$envs_dict[$env->key] = $escapedValue;
@@ -2040,8 +2038,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
if (isDev()) {
$this->application_deployment_queue->addLogEntry("[DEBUG] Build-time env: {$env->key}");
$this->application_deployment_queue->addLogEntry('[DEBUG] Type: normal (allows expansion)');
$this->application_deployment_queue->addLogEntry("[DEBUG] real_value: {$resolvedValue}");
$this->application_deployment_queue->addLogEntry("[DEBUG] final escaped: {$escapedValue}");
$this->application_deployment_queue->addLogEntry('[DEBUG] Value length: '.strlen($escapedValue));
}
}
}
@@ -2076,7 +2073,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
$escapedValue = escapeBashEnvValue($value);
if (isDev() && isset($envs_dict[$env->key])) {
$this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (was: {$envs_dict[$env->key]}, now: {$escapedValue})");
$this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (value replaced)");
}
$envs_dict[$env->key] = $escapedValue;
@@ -2084,16 +2081,14 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
if (isDev()) {
$this->application_deployment_queue->addLogEntry("[DEBUG] Build-time env: {$env->key}");
$this->application_deployment_queue->addLogEntry('[DEBUG] Type: literal/multiline');
$this->application_deployment_queue->addLogEntry("[DEBUG] raw real_value: {$resolvedValue}");
$this->application_deployment_queue->addLogEntry("[DEBUG] stripped value: {$value}");
$this->application_deployment_queue->addLogEntry("[DEBUG] final escaped: {$escapedValue}");
$this->application_deployment_queue->addLogEntry('[DEBUG] Value length: '.strlen($escapedValue));
}
} else {
// For normal vars, use double quotes to allow $VAR expansion
$escapedValue = escapeBashDoubleQuoted($resolvedValue);
if (isDev() && isset($envs_dict[$env->key])) {
$this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (was: {$envs_dict[$env->key]}, now: {$escapedValue})");
$this->application_deployment_queue->addLogEntry("[DEBUG] User override: {$env->key} (value replaced)");
}
$envs_dict[$env->key] = $escapedValue;
@@ -2101,8 +2096,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
if (isDev()) {
$this->application_deployment_queue->addLogEntry("[DEBUG] Build-time env: {$env->key}");
$this->application_deployment_queue->addLogEntry('[DEBUG] Type: normal (allows expansion)');
$this->application_deployment_queue->addLogEntry("[DEBUG] real_value: {$resolvedValue}");
$this->application_deployment_queue->addLogEntry("[DEBUG] final escaped: {$escapedValue}");
$this->application_deployment_queue->addLogEntry('[DEBUG] Value length: '.strlen($escapedValue));
}
}
}
tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
+19 -2
View File
@@ -97,8 +97,7 @@ it('does not retain locked values from generated build-time debug logs', functio
expect($retainedLogs)
->not->toContain('harmless-single-marker')
->not->toContain('harmless-first-marker')
->not->toContain('harmless-second-marker')
->toContain(REDACTED);
->not->toContain('harmless-second-marker');
$member = User::factory()->create();
$application->team()->members()->attach($member->id, ['role' => 'member']);
@@ -112,6 +111,24 @@ it('does not retain locked values from generated build-time debug logs', functio
->not->toContain('harmless-second-marker');
});
it('does not print build-time values in the development debug lines', function () {
config()->set('app.env', 'local');
[$application, $server] = makeDeploymentControlVarFixture();
createApplicationEnvironmentVariable($application, ['key' => 'DB_PASSWORD', 'value' => 'normal-secret-marker']);
createApplicationEnvironmentVariable($application, ['key' => 'LITERAL_TOKEN', 'value' => 'literal-secret-marker', 'is_literal' => true]);
[$job, $reflection] = makeControlVarFilteringJob($application, $server);
invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables');
$debugLines = collect($job->recordedLogEntries)->filter(fn (string $line) => str_contains($line, '[DEBUG]'))->implode("\n");
expect($debugLines)
->toContain('[DEBUG] Build-time env: DB_PASSWORD')
->toContain('[DEBUG] Build-time env: LITERAL_TOKEN')
->not->toContain('normal-secret-marker')
->not->toContain('literal-secret-marker');
});
it('redacts generated multiline forms in remote command and output logging', function () {
[$application, $server] = makeDeploymentControlVarFixture();
createApplicationEnvironmentVariable($application, [