Warn user about tokens in comments/issues
Context
GitLab users making issues or writing comments may accidentally include a sensitive token. Sometimes this happens as a result of copy+paste or not understanding the sensitive nature of the token. Many of these tokens are highly sensitive and their exposure can result in a security incident. For example a GitLab Personal Access Token being leaked can be very high impact.
Suggestion
It would be great if the GitLab user interface warned someone before submitting the issue/comment if it contained a token. Something like This message appears to have a token in it. Are you sure you want to post it?
. This would give users a chance to verify whether or not they meant to include a token in the message or alert them to one that they didn't know was included.
If possible, we could look at the personal access token prefix that has been configured for the GitLab instance (or use glpat
by default).
Types of tokens
There are a number of types of tokens we could be looking for:
- GitLab Personal Access Tokens
- Gitlab Project Access Tokens
- GitLab Group Access Tokens
- GitLab Feed Tokens (usually in a URL, ex
feed_token=SOME_TOKEN_HERE
) - Tokens from other services
Implementation Plan (In-progress)
- Build a service for detecting all possible types tokens in frontend. This should be extendable.
- Find potential areas where the comments are added
- Review comments
- Notes commments
- Threads
- Issue Description
- MR Description
- ...
- Add the service to the aforementioned areas and show the confirmation modal with a warning