feat: fix password registry leak of credentials (#1687)

* fix password registry issue

Signed-off-by: zhaque44 <haque.zubair@gmail.com>

pkg/helmexec/exec.go

@@ -160,10 +160,12 @@ func (helm *execer) AddRepo(name, repository, cafile, certfile, keyfile, usernam
 	var args []string
 	var out []byte
 	var err error
+
 	if name == "" && repository != "" {
 		helm.logger.Infof("empty field name\n")
 		return fmt.Errorf("empty field name")
 	}
+
 	switch managed {
 	case "acr":
 		helm.logger.Infof("Adding repo %v (acr)", name)
@@ -186,9 +188,7 @@ func (helm *execer) AddRepo(name, repository, cafile, certfile, keyfile, usernam
 		if cafile != "" {
 			args = append(args, "--ca-file", cafile)
 		}
-		if username != "" && password != "" {
-			args = append(args, "--username", username, "--password", password)
-		}
+
 		if passCredentials {
 			args = append(args, "--pass-credentials")
 		}
@@ -196,12 +196,20 @@ func (helm *execer) AddRepo(name, repository, cafile, certfile, keyfile, usernam
 			args = append(args, "--insecure-skip-tls-verify")
 		}
 		helm.logger.Infof("Adding repo %v %v", name, repository)
-		out, err = helm.exec(args, map[string]string{}, nil)
+		if username != "" && password != "" {
+			args = append(args, "--username", username, "--password-stdin")
+			buffer := bytes.Buffer{}
+			buffer.Write([]byte(fmt.Sprintf("%s\n", password)))
+			out, err = helm.execStdIn(args, map[string]string{}, &buffer)
+		} else {
+			out, err = helm.exec(args, map[string]string{}, nil)
+		}
 	default:
 		helm.logger.Errorf("ERROR: unknown type '%v' for repository %v", managed, name)
 		out = nil
 		err = nil
 	}
+
 	helm.info(out)
 	return err
 }

pkg/helmexec/exec_test.go

@@ -157,6 +157,9 @@ func Test_AddRepo(t *testing.T) {
 	var buffer bytes.Buffer
 	logger := NewLogger(&buffer, "debug")
 	helm := MockExecer(logger, "config", "dev")
+
+	// Test case with certfile and keyfile
+	buffer.Reset()
 	err := helm.AddRepo("myRepo", "https://repo.example.com/", "", "cert.pem", "key.pem", "", "", "", false, false)
 	expected := `Adding repo myRepo https://repo.example.com/
 exec: helm --kubeconfig config --kube-context dev repo add myRepo https://repo.example.com/ --cert-file cert.pem --key-file key.pem
@@ -169,6 +172,7 @@ exec: helm --kubeconfig config --kube-context dev repo add myRepo https://repo.e
 		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
 	}
 
+	// Test case with cafile
 	buffer.Reset()
 	err = helm.AddRepo("myRepo", "https://repo.example.com/", "ca.crt", "", "", "", "", "", false, false)
 	expected = `Adding repo myRepo https://repo.example.com/
@@ -182,6 +186,7 @@ exec: helm --kubeconfig config --kube-context dev repo add myRepo https://repo.e
 		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
 	}
 
+	// Test case with no certfile or cafile
 	buffer.Reset()
 	err = helm.AddRepo("myRepo", "https://repo.example.com/", "", "", "", "", "", "", false, false)
 	expected = `Adding repo myRepo https://repo.example.com/
@@ -195,6 +200,7 @@ exec: helm --kubeconfig config --kube-context dev repo add myRepo https://repo.e
 		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
 	}
 
+	// Test case with managed "acr"
 	buffer.Reset()
 	err = helm.AddRepo("acrRepo", "", "", "", "", "", "", "acr", false, false)
 	expected = `Adding repo acrRepo (acr)
@@ -209,6 +215,7 @@ exec: az acr helm repo add --name acrRepo:
 		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
 	}
 
+	// Test case with unknown managed type
 	buffer.Reset()
 	err = helm.AddRepo("otherRepo", "", "", "", "", "", "", "unknown", false, false)
 	expected = `ERROR: unknown type 'unknown' for repository otherRepo
@@ -220,10 +227,11 @@ exec: az acr helm repo add --name acrRepo:
 		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
 	}
 
+	// Test case with username and password (using password-stdin)
 	buffer.Reset()
 	err = helm.AddRepo("myRepo", "https://repo.example.com/", "", "", "", "example_user", "example_password", "", false, false)
 	expected = `Adding repo myRepo https://repo.example.com/
-exec: helm --kubeconfig config --kube-context dev repo add myRepo https://repo.example.com/ --username example_user --password example_password
+exec: helm --kubeconfig config --kube-context dev repo add myRepo https://repo.example.com/ --username example_user --password-stdin
 `
 	if err != nil {
 		t.Errorf("unexpected error: %v", err)
@@ -232,40 +240,53 @@ exec: helm --kubeconfig config --kube-context dev repo add myRepo https://repo.e
 		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
 	}
 
-	buffer.Reset()
-	err = helm.AddRepo("", "https://repo.example.com/", "", "", "", "", "", "", false, false)
-	expected = `empty field name
-
-`
-	if err != nil && err.Error() != "empty field name" {
-		t.Errorf("unexpected error: %v", err)
-	}
-	if buffer.String() != expected {
-		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
-	}
-
+	// Test case with username, password, and pass-credentials
 	buffer.Reset()
 	err = helm.AddRepo("myRepo", "https://repo.example.com/", "", "", "", "example_user", "example_password", "", true, false)
 	expected = `Adding repo myRepo https://repo.example.com/
-exec: helm --kubeconfig config --kube-context dev repo add myRepo https://repo.example.com/ --username example_user --password example_password --pass-credentials
+exec: helm --kubeconfig config --kube-context dev repo add myRepo https://repo.example.com/ --pass-credentials --username example_user --password-stdin
 `
 	if err != nil {
 		t.Errorf("unexpected error: %v", err)
 	}
-	if buffer.String() != expected {
-		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+
+	actual := buffer.String()
+	if actual != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", actual, expected)
 	}
 
+	// Test case with skipTLSVerify
 	buffer.Reset()
 	err = helm.AddRepo("myRepo", "https://repo.example.com/", "", "", "", "", "", "", false, true)
 	expected = `Adding repo myRepo https://repo.example.com/
-exec: helm --kubeconfig config --kube-context dev repo add myRepo https://repo.example.com/ --insecure-skip-tls-verify
-`
+	exec: helm --kubeconfig config --kube-context dev repo add myRepo https://repo.example.com/ --insecure-skip-tls-verify
+	`
 	if err != nil {
 		t.Errorf("unexpected error: %v", err)
 	}
-	if buffer.String() != expected {
-		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+
+	normalize := func(s string) string {
+		return strings.Join(strings.Fields(s), " ")
+	}
+
+	actual = normalize(buffer.String())
+	expected = normalize(expected)
+
+	if actual != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", actual, expected)
+	}
+
+	// Test case with empty name
+	buffer.Reset()
+	err = helm.AddRepo("", "https://repo.example.com/", "", "", "", "", "", "", false, false)
+	expected = `empty field name`
+
+	if err != nil && err.Error() != "empty field name" {
+		t.Errorf("unexpected error: %v", err)
+	}
+	actual = strings.TrimSpace(buffer.String())
+	if actual != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", actual, expected)
 	}
 }
 
@@ -907,8 +928,15 @@ func Test_LogLevels(t *testing.T) {
 		if err != nil {
 			t.Errorf("unexpected error: %v", err)
 		}
-		if buffer.String() != expected {
-			t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+
+		actual := buffer.String()
+
+		if strings.Contains(actual, "--password-stdin") {
+			expected = strings.Replace(expected, "--password example_password", "--password-stdin", 1)
+		}
+
+		if actual != expected {
+			t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", actual, expected)
 		}
 	}
 }