acorn-io/runtime

Allowed to edit secrets of type "basic" and "token" and set values that do not conform with `length` and `characters` params.

sangee2004 opened this issue · 1 comments

acorn version - v0.9.2-28-ga822ff9d+a822ff9d

Steps to reproduce the problem:

  1. Deploy secrets of type "token" with length and characters` params.
secrets: {
    password: {
        type: "token"
        params: {
            length: 10
            characters : "A-Za-z0-9$"
        }
}
}
  1. Once secret is created , use acorn edit and set the token value to "q4Quh8zpJk*9078787887" which breaks the length and characters restriction.
  2. Edit succeeds and "token" gets set with values that do not conform to the length and characters restriction.
acorn secret reveal mytoken.password 
NAME               TYPE      KEY       VALUE
mytoken.password   token     token     q4Quh8zpJk*9078787887

Expected Behavior:
Edit secret fail in this case and not update token with values that do not conform to the length and characters restriction.

Note - The same behavior is also seen for secrets created with type "basic" and have length and characters restriction.

From @ibuildthecloud The parameters are for the generation of the values, not for validating the values.

Closing this issue.