Skip to content

Commit d0bcce1

Browse files
nguerreranguerrera
committed
Update Microsoft.Security.Utilities.Core from v1.17.0 to v1.18.0
Release Notes: https://github.com/microsoft/security-utilities/blob/release/v1.18.0/docs/ReleaseHistory.md
1 parent 5453c1a commit d0bcce1

17 files changed

+219
-163
lines changed

‎src/Agent.Sdk/Agent.Sdk.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
</PropertyGroup>
88

99
<ItemGroup>
10-
<PackageReference Include="Microsoft.Security.Utilities.Core" Version="1.17.0" />
10+
<PackageReference Include="Microsoft.Security.Utilities.Core" Version="1.18.0" />
1111
<PackageReference Include="Microsoft.Win32.Registry" Version="5.0.0" />
1212
<PackageReference Include="System.IO.FileSystem.AccessControl" Version="6.0.0-preview.5.21301.5" />
1313
<PackageReference Include="System.Management" Version="4.7.0" />

‎src/Agent.Sdk/SecretMasking/ILoggedSecretMasker.cs

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,21 @@
33

44
using System;
55

6-
using Microsoft.TeamFoundation.DistributedTask.Logging;
7-
86
namespace Agent.Sdk.SecretMasking
97
{
108
/// <summary>
119
/// Extended ISecretMasker interface that adds support for logging the origin of
1210
/// regexes, encoders and literal secret values.
1311
/// </summary>
14-
public interface ILoggedSecretMasker : ISecretMasker, IDisposable
12+
public interface ILoggedSecretMasker : IDisposable
1513
{
16-
static int MinSecretLengthLimit { get; }
14+
int MinSecretLength { get; set; }
1715

18-
void AddRegex(String pattern, string origin);
19-
void AddValue(String value, string origin);
20-
void AddValueEncoder(ValueEncoder encoder, string origin);
16+
void AddRegex(string pattern, string origin);
17+
void AddValue(string value, string origin);
18+
void AddValueEncoder(Func<string, string> encoder, string origin);
19+
string MaskSecrets(string input);
20+
void RemoveShortSecretsFromDictionary();
2121
void SetTrace(ITraceWriter trace);
2222
}
2323
}

‎src/Agent.Sdk/SecretMasking/IRawSecretMasker.cs

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
// Copyright (c) Microsoft Corporation.
2+
// Licensed under the MIT License.
3+
using System;
4+
5+
namespace Agent.Sdk.SecretMasking
6+
{
7+
/// <summary>
8+
/// Rerpresents a raw secret masker without the features that <see
9+
/// cref="ILoggedSecretMasker"/> adds.
10+
/// </summary>
11+
public interface IRawSecretMasker : IDisposable
12+
{
13+
int MinSecretLength { get; set; }
14+
15+
void AddRegex(string pattern);
16+
void AddValue(string value);
17+
void AddValueEncoder(Func<string, string> encoder);
18+
string MaskSecrets(string input);
19+
void RemoveShortSecretsFromDictionary();
20+
}
21+
}

‎src/Agent.Sdk/SecretMasking/LegacySecretMasker.cs

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
// Copyright (c) Microsoft Corporation.
2+
// Licensed under the MIT License.
3+
using System;
4+
5+
using Microsoft.TeamFoundation.DistributedTask.Logging;
6+
7+
namespace Agent.Sdk.SecretMasking
8+
{
9+
/// <summary>
10+
/// Legacy secret masker that dispatches to <see cref="SecretMasker"/> from
11+
/// 'Microsoft.TeamFoundation.DistributedTask.Logging'.
12+
/// </summary>
13+
public sealed class LegacySecretMasker : IRawSecretMasker
14+
{
15+
private SecretMasker _secretMasker = new();
16+
17+
public int MinSecretLength
18+
{
19+
get => _secretMasker.MinSecretLength;
20+
set => _secretMasker.MinSecretLength = value;
21+
}
22+
23+
public void AddRegex(string pattern)
24+
{
25+
_secretMasker.AddRegex(pattern);
26+
}
27+
28+
public void AddValue(string value)
29+
{
30+
_secretMasker.AddValue(value);
31+
}
32+
33+
public void AddValueEncoder(Func<string, string> encoder)
34+
{
35+
_secretMasker.AddValueEncoder(x => encoder(x));
36+
}
37+
38+
public void Dispose()
39+
{
40+
_secretMasker?.Dispose();
41+
_secretMasker = null;
42+
}
43+
44+
public string MaskSecrets(string input)
45+
{
46+
return _secretMasker.MaskSecrets(input);
47+
}
48+
49+
public void RemoveShortSecretsFromDictionary()
50+
{
51+
_secretMasker.RemoveShortSecretsFromDictionary();
52+
}
53+
}
54+
}

‎src/Agent.Sdk/SecretMasking/LoggedSecretMasker.cs

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,31 +3,28 @@
33
// Licensed under the MIT License.
44
using System;
55

6-
using Microsoft.TeamFoundation.DistributedTask.Logging;
7-
86
namespace Agent.Sdk.SecretMasking
97
{
108
/// <summary>
119
/// Extended secret masker service that allows specifying the origin of any
12-
/// masking operation. It works by wrapping an existing ISecretMasker
10+
/// masking operation. It works by wrapping an existing IRawSecretMasker
1311
/// implementation and an optionally settable ITraceWriter instance for
1412
/// secret origin logging operations. In the agent today, this class can be
15-
/// initialized with two distinct ISecretMasker implementations, the one
13+
/// initialized with two distinct IRawSecretMasker implementations, the one
1614
/// that ships in VSO itself, and the official Microsoft open source secret
1715
/// masker, implemented at https://github/microsoft/security-utilities.
1816
/// </summary>
1917
public class LoggedSecretMasker : ILoggedSecretMasker
2018
{
21-
private ISecretMasker _secretMasker;
19+
private IRawSecretMasker _secretMasker;
2220
private ITraceWriter _trace;
2321

24-
2522
private void Trace(string msg)
2623
{
2724
this._trace?.Info(msg);
2825
}
2926

30-
public LoggedSecretMasker(ISecretMasker secretMasker)
27+
public LoggedSecretMasker(IRawSecretMasker secretMasker)
3128
{
3229
this._secretMasker = secretMasker;
3330
}
@@ -111,18 +108,17 @@ public void RemoveShortSecretsFromDictionary()
111108
_secretMasker.RemoveShortSecretsFromDictionary();
112109
}
113110

114-
public void AddValueEncoder(ValueEncoder encoder)
111+
public void AddValueEncoder(Func<string, string> encoder)
115112
{
116113
this._secretMasker.AddValueEncoder(encoder);
117114
}
118115

119-
120116
/// <summary>
121117
/// Overloading of AddValueEncoder method with additional logic for logging origin of provided secret
122118
/// </summary>
123119
/// <param name="encoder"></param>
124120
/// <param name="origin"></param>
125-
public void AddValueEncoder(ValueEncoder encoder, string origin)
121+
public void AddValueEncoder(Func<string, string> encoder, string origin)
126122
{
127123
this.Trace($"Setting up value for origin: {origin}");
128124
if (encoder == null)
@@ -134,18 +130,11 @@ public void AddValueEncoder(ValueEncoder encoder, string origin)
134130
AddValueEncoder(encoder);
135131
}
136132

137-
public LoggedSecretMasker Clone()
138-
{
139-
return new LoggedSecretMasker(this._secretMasker.Clone());
140-
}
141-
142133
public string MaskSecrets(string input)
143134
{
144135
return this._secretMasker.MaskSecrets(input);
145136
}
146137

147-
ISecretMasker ISecretMasker.Clone() => this.Clone();
148-
149138
public void Dispose()
150139
{
151140
Dispose(true);

‎src/Agent.Sdk/SecretMasking/OssSecretMasker.cs

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,10 @@
55
using System.Text.RegularExpressions;
66
using Microsoft.Security.Utilities;
77

8-
using ISecretMasker = Microsoft.TeamFoundation.DistributedTask.Logging.ISecretMasker;
9-
using ValueEncoder = Microsoft.TeamFoundation.DistributedTask.Logging.ValueEncoder;
108

119
namespace Agent.Sdk.SecretMasking;
1210

13-
public sealed class OssSecretMasker : ISecretMasker, IDisposable
11+
public sealed class OssSecretMasker : IRawSecretMasker
1412
{
1513
private SecretMasker _secretMasker;
1614

@@ -24,10 +22,6 @@ public OssSecretMasker(IEnumerable<RegexPattern> patterns)
2422
_secretMasker.DefaultRegexRedactionToken = "***";
2523
}
2624

27-
private OssSecretMasker(OssSecretMasker copy)
28-
{
29-
_secretMasker = copy._secretMasker.Clone();
30-
}
3125

3226
/// <summary>
3327
/// This property allows to set the minimum length of a secret for masking
@@ -70,13 +64,11 @@ public void AddValue(string test)
7064
/// <summary>
7165
/// This implementation assumes no more than one thread is adding regexes, values, or encoders at any given time.
7266
/// </summary>
73-
public void AddValueEncoder(ValueEncoder encoder)
67+
public void AddValueEncoder(Func<string, string> encoder)
7468
{
7569
_secretMasker.AddLiteralEncoder(x => encoder(x));
7670
}
7771

78-
public OssSecretMasker Clone() => new OssSecretMasker(this);
79-
8072
public void Dispose()
8173
{
8274
_secretMasker?.Dispose();
@@ -152,6 +144,4 @@ public void RemoveShortSecretsFromDictionary()
152144
}
153145
}
154146
}
155-
156-
ISecretMasker ISecretMasker.Clone() => this.Clone();
157147
}

‎src/Agent.Worker/ContainerOperationProvider.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -298,7 +298,7 @@ private async Task<string> GetAcrPasswordFromAADToken(IExecutionContext executio
298298
}
299299

300300
// Mark retrieved password as secret
301-
HostContext.SecretMasker.AddValue(AcrPassword);
301+
HostContext.SecretMasker.AddValue(AcrPassword, origin: "AcrPassword");
302302

303303
return AcrPassword;
304304
}

‎src/Agent.Worker/ExpressionManager.cs

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,14 @@ public ConditionResult Evaluate(IExecutionContext executionContext, IExpressionN
5252
ConditionResult result = new ConditionResult();
5353
var expressionTrace = new TraceWriter(Trace, hostTracingOnly ? null : executionContext);
5454

55-
result.Value = tree.Evaluate<bool>(trace: expressionTrace, secretMasker: HostContext.SecretMasker, state: executionContext);
55+
// NOTE: We pass null for the secretMasker here because the trace
56+
// that we pass will handle secret masking as will upstream
57+
// exception handlers. It would therefore be redundant for
58+
// IExpressionNode.Evaluate to perform secret masking. Furthermore,
59+
// IExpressionNode.Evaluate requires an implementation of the server
60+
// ISecretMasker interface that the agent secret masker does not
61+
// implement as the agent secret masker cannot support cloning.
62+
result.Value = tree.Evaluate<bool>(trace: expressionTrace, secretMasker: null, state: executionContext);
5663
result.Trace = expressionTrace.Trace;
5764

5865
return result;

‎src/Microsoft.VisualStudio.Services.Agent/HostContext.cs

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,6 @@
2323
using Agent.Sdk.Util;
2424
using Microsoft.TeamFoundation.DistributedTask.Logging;
2525
using Microsoft.Security.Utilities;
26-
using LegacySecretMasker = Microsoft.TeamFoundation.DistributedTask.Logging.SecretMasker;
27-
using ISecretMasker = Microsoft.TeamFoundation.DistributedTask.Logging.ISecretMasker;
2826

2927
namespace Microsoft.VisualStudio.Services.Agent
3028
{
@@ -179,7 +177,7 @@ private ILoggedSecretMasker CreateSecretMasker()
179177
bool enableNewMaskerAndRegexes = AgentKnobs.EnableNewMaskerAndRegexes.GetValue(this).AsBoolean();
180178

181179
#pragma warning disable CA2000 // Dispose objects before losing scope. False positive: LoggedSecretMasker takes ownership.
182-
ISecretMasker rawSecretMasker;
180+
IRawSecretMasker rawSecretMasker;
183181
if (enableNewMaskerAndRegexes)
184182
{
185183
rawSecretMasker = new OssSecretMasker(WellKnownRegexPatterns.PreciselyClassifiedSecurityKeys);

‎src/Microsoft.VisualStudio.Services.Agent/TraceManager.cs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
using System;
66
using System.Collections.Concurrent;
77
using System.Diagnostics;
8-
using Microsoft.TeamFoundation.DistributedTask.Logging;
8+
using Agent.Sdk.SecretMasking;
99

1010
namespace Microsoft.VisualStudio.Services.Agent
1111
{
@@ -20,14 +20,14 @@ public sealed class TraceManager : ITraceManager
2020
private readonly ConcurrentDictionary<string, Tracing> _sources = new ConcurrentDictionary<string, Tracing>(StringComparer.OrdinalIgnoreCase);
2121
private readonly HostTraceListener _hostTraceListener;
2222
private TraceSetting _traceSetting;
23-
private ISecretMasker _secretMasker;
23+
private ILoggedSecretMasker _secretMasker;
2424

25-
public TraceManager(HostTraceListener traceListener, ISecretMasker secretMasker)
25+
public TraceManager(HostTraceListener traceListener, ILoggedSecretMasker secretMasker)
2626
: this(traceListener, new TraceSetting(), secretMasker)
2727
{
2828
}
2929

30-
public TraceManager(HostTraceListener traceListener, TraceSetting traceSetting, ISecretMasker secretMasker)
30+
public TraceManager(HostTraceListener traceListener, TraceSetting traceSetting, ILoggedSecretMasker secretMasker)
3131
{
3232
// Validate and store params.
3333
ArgUtil.NotNull(traceListener, nameof(traceListener));

0 commit comments

Comments
 (0)