enhance: sanitize events from response

go-vela · Jan 2, 2025 · a08ac8b · a08ac8b
1 parent 2d6555c
commit a08ac8b
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 0 deletions.
diff --git a/api/build/status.go b/api/build/status.go
@@ -61,5 +61,10 @@ func GetStatus(c *gin.Context) {
 
 	l.Debug("reading status for build")
 
+	// sanitize fields for the unauthenticated response
+	if b.Repo != nil {
+		b.Repo.StatusSanitize()
+	}
+
 	c.JSON(http.StatusOK, b)
 }
diff --git a/api/repo/status.go b/api/repo/status.go
@@ -57,5 +57,8 @@ func GetStatus(c *gin.Context) {
 
 	l.Debug("reading status for repo")
 
+	// sanitize fields for the unauthenticated response
+	r.StatusSanitize()
+
 	c.JSON(http.StatusOK, r)
 }
diff --git a/api/types/repo.go b/api/types/repo.go
@@ -723,3 +723,9 @@ func (r *Repo) String() string {
 		r.GetInstallID(),
 	)
 }
+
+// StatusSanitize removes sensitive information before producing a "status".
+func (r *Repo) StatusSanitize() {
+	// remove allowed events
+	r.AllowEvents = nil
+}