Token prefix masking: prefix appears on rightside of `[MASKED]`
We're occasionally seeing an issue where token prefix masking is inserting [MASKED]
into the incorrect location.
We expect the prefix to remain, and the secret to be masked, such as: glpat-[MASKED]
. What we occasionally see is [MASKED]glpat-
.
Potential reasons
- It's possible that the way we merge different log streams together can be interfering with the masking. This is a problem that we're aware of, but it may not be the cause of this. Proposal to improve build logs (#30826 - closed)
- Perhaps it's an alignment issue. Masking works at the byte boundaries, so maybe it's UTF-8 encoding related.
We can hopefully extract the raw log from one of these jobs that can reproduce the issue and examine them. We can't seem to write a test that captures the problem yet.