From 9529c24f6d34fd52b4d77f55f0723f17712aa38e Mon Sep 17 00:00:00 2001
From: Tim Hockin <thockin@google.com>
Date: Wed, 13 Jul 2022 09:17:43 -0700
Subject: [PATCH 1/2] Redact password when logging args

---
 cmd/git-sync/main.go | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/cmd/git-sync/main.go b/cmd/git-sync/main.go
index fb8eda1..aa06fdc 100644
--- a/cmd/git-sync/main.go
+++ b/cmd/git-sync/main.go
@@ -430,7 +430,7 @@ func main() {
 		"uid", os.Getuid(),
 		"gid", os.Getgid(),
 		"home", os.Getenv("HOME"),
-		"args", os.Args)
+		"args", logSafeArgs(os.Args))
 
 	if _, err := exec.LookPath(*flGitCmd); err != nil {
 		log.Error(err, "ERROR: git executable not found", "git", *flGitCmd)
@@ -717,6 +717,30 @@ func main() {
 	}
 }
 
+// logSafeArgs makes sure any sensitive args (e.g. passwords) are redacted
+// before logging.
+func logSafeArgs(args []string) []string {
+	const redacted = "<REDACTED>"
+
+	ret := make([]string, len(args))
+	redact := false
+	for i, arg := range args {
+		if redact {
+			ret[i] = redacted
+			redact = false
+			continue
+		}
+		if arg == "--password" {
+			redact = true
+		}
+		if strings.HasPrefix(arg, "--password=") {
+			arg = "--password=" + redacted
+		}
+		ret[i] = arg
+	}
+	return ret
+}
+
 func normalizePath(path string) (string, error) {
 	delinked, err := filepath.EvalSymlinks(path)
 	if err != nil {

From 0b92a4971cf9eaa9180db996fd0a06d0cd320df6 Mon Sep 17 00:00:00 2001
From: Tim Hockin <thockin@google.com>
Date: Wed, 13 Jul 2022 09:50:18 -0700
Subject: [PATCH 2/2] Log env at startup

---
 cmd/git-sync/main.go | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/cmd/git-sync/main.go b/cmd/git-sync/main.go
index aa06fdc..5186f68 100644
--- a/cmd/git-sync/main.go
+++ b/cmd/git-sync/main.go
@@ -430,7 +430,8 @@ func main() {
 		"uid", os.Getuid(),
 		"gid", os.Getgid(),
 		"home", os.Getenv("HOME"),
-		"args", logSafeArgs(os.Args))
+		"args", logSafeArgs(os.Args),
+		"env", logSafeEnv(os.Environ()))
 
 	if _, err := exec.LookPath(*flGitCmd); err != nil {
 		log.Error(err, "ERROR: git executable not found", "git", *flGitCmd)
@@ -717,16 +718,16 @@ func main() {
 	}
 }
 
+const redactedString = "<REDACTED>"
+
 // logSafeArgs makes sure any sensitive args (e.g. passwords) are redacted
 // before logging.
 func logSafeArgs(args []string) []string {
-	const redacted = "<REDACTED>"
-
 	ret := make([]string, len(args))
 	redact := false
 	for i, arg := range args {
 		if redact {
-			ret[i] = redacted
+			ret[i] = redactedString
 			redact = false
 			continue
 		}
@@ -734,13 +735,26 @@ func logSafeArgs(args []string) []string {
 			redact = true
 		}
 		if strings.HasPrefix(arg, "--password=") {
-			arg = "--password=" + redacted
+			arg = "--password=" + redactedString
 		}
 		ret[i] = arg
 	}
 	return ret
 }
 
+// logSafeEnv makes sure any sensitive env vars (e.g. passwords) are redacted
+// before logging.
+func logSafeEnv(env []string) []string {
+	ret := make([]string, len(env))
+	for i, ev := range env {
+		if strings.HasPrefix(ev, "GIT_SYNC_PASSWORD=") {
+			ev = "GIT_SYNC_PASSWORD=" + redactedString
+		}
+		ret[i] = ev
+	}
+	return ret
+}
+
 func normalizePath(path string) (string, error) {
 	delinked, err := filepath.EvalSymlinks(path)
 	if err != nil {