Github token secret partially displayed when error occurs

[dannystaple]

The formatting library to nicely present tracebacks does so in a way that shows a partial version of a secret token. This partial version is not blotted out by the GitHub secret mechanism.

Either the locals display should be removed from this, or the secrets eliminated. Either way, even a partial secret reveal is a problem.

[carlcsaposs-canonical]

Thank you very much!

This is fixed in v1.0.1

As long as the GITHUB_TOKEN was passed to the github-token input (and a long-lived secret like a personal access token was not passed), the practical impact of this vulnerability should be limited—since the GITHUB_TOKEN is revoked after the job completes.

However, this is still an important vulnerability since a leaked GITHUB_TOKEN could lead to attacks executed in the time between the token leak & the completion of the job. For example: https://www.praetorian.com/blog/codeqleaked-public-secrets-exposure-leads-to-supply-chain-attack-on-github-codeql/

Thank you for the report!

[carlcsaposs-canonical]

Security advisory: GHSA-26wh-cc3r-w6pj