Summary

Renovate previously had a gap in its log sanitisation for TLS private keys used for Mutual TLS.

When configuring a Host Rule that requires a TLS certificate (when performing Mutual TLS), Renovate sanitises the httpsPrivateKey log line, such as:

DEBUG: File config
       "config": {
         "hostRules": [{"matchHost": "example.com", "httpsPrivateKey": "***********"}]
       }

However, if that full key was referenced in another field (whether another config option, or outputted in a log message with a key that was not httpsPrivateKey) it may have logged the full value.

For instance, with a very contrived example:

module.exports = {
	hostRules: [
		{
			matchHost: 'example.com',
            // NOT the correct handling: you should be passing these `secrets`
			httpsPrivateKey: 'BEGIN PRIVATE KEY',
		},
	],
	// contrived example to show the issue, which is NOT correctly handling a secret
	username: 'BEGIN PRIVATE KEY',
}

This would then log i.e.:

DEBUG: Platform config
       "platformConfig": {
         "hostType": "github",
         "endpoint": "https://api.github.com/",
         "isGHApp": false,
         "isGhe": false,
         "isGheCloud": false,
         "userDetails": {
           "username": "jamietanna",
           "name": "Jamie Tanna",
           "id": 3315059,
           "email": null
         },
         "userEmail": null
       },
       "renovateUsername": "BEGIN PRIVATE KEY"

Renovate previously would not sanitise this correctly.

This is somewhat expected for users who are not following the documented recommendations to pass secrets through the secrets configuration.

However, we have fixed this to ensure that any values put into hostRules[].httpsPrivateKey will be redacted anywhere they're found in Renovate's logs.

Impact

• If you are using Mutual TLS
• If you are configuring it through hostRules[].httpsPrivateKey
• If you are not following documented best practices to pass secrets through the secrets configuration
• If Renovate logs:
  • A field that is not literally called httpsPrivateKey
  • That field is referencing the full secret value

Patches

This is patched in Renovate 44.14.4.

Workarounds

Manage secrets through secrets, such as:

module.exports = {
	secrets: {
        
		FOO: 'BEGIN PRIVATE KEY',
	},
	hostRules: [
		{
			matchHost: 'example.com',
            // correct handling
			httpsPrivateKey: '{{ secrets.FOO }}',
		},
	],
	// incorrectly handled, but will be sanitised
	username: 'BEGIN PRIVATE KEY',
}

module.exports = config;

When tested on 44.14.3 (prior to the patch), you will see this is correctly redacted:

DEBUG: Platform config
       "platformConfig": {
         "hostType": "github",
         "endpoint": "https://api.github.com/",
         "isGHApp": false,
         "isGhe": false,
         "isGheCloud": false,
         "userDetails": {
           "username": "jamietanna",
           "name": "Jamie Tanna",
           "id": 3315059,
           "email": null
         },
         "userEmail": null
       },
       "renovateUsername": "**redacted**"

Notes

The fix applies redaction to httpsPrivateKey, httpsCertificate and httpsCertificateAuthority.

Even though httpsCertificate and httpsCertificateAuthority are generally "public" and "safe" to log, we are currently redacting them out of an abundance of caution, and are happy to discuss removing redaction.