Skip to content

GitLab

  • Menu
Projects Groups Snippets
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
  • Sign in
  • L lavacli
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 3
    • Issues 3
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 1
    • Merge requests 1
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Packages & Registries
    • Packages & Registries
    • Container Registry
  • Analytics
    • Analytics
    • CI/CD
    • Repository
    • Value stream
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • lava
  • lavacli
  • Issues
  • #21

Closed
Open
Created Feb 24, 2023 by Paul Sokolovsky@pfalcon

lavacli outputs error message to stdout instead of stderr (security issue!)

Please look at the code https://git.lavasoftware.org/lava/lavacli/-/blob/master/lavacli/__init__.py#L272 . All the exception handlers print() error message to stdout (also reproduced with lavacli 1.0 here). If lavacli's output is redirected (more than natural for lavacli jobs logs, etc.), the error message will end up in the file. Then combined with #20 (closed), that file may contain sensitive information, which may be overlooked by a user and shared with unintended audience. All this may happen in automated manner via a CI system for example.

All error messages should be output to stderr.

Edited Feb 24, 2023 by Paul Sokolovsky
Assignee
Assign to
Time tracking