Repository navigation
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Two moderate secret-redaction gaps remain for header values and malformed RPC URLs.
1 open issue
What changed in this PR
This pull request redacts secrets from contract invoke/deploy usage output.
Changes:
- Conceals secret-shaped arguments and URL passwords.
- Adds unit coverage for redaction behavior.
| File | Summary |
|---|---|
cmd/soroban-cli/src/commands/contract/arg_parsing.rs |
Implements command-line concealment and tests. |
Review effort: Lite
leighmcculloch
approved these changes
Oct 19, 2026
fnando
force-pushed
the
conceal-secrets-in-contract-invoke-usage
branch
3 times, most recently
from
October 19, 2026 23:14
b731f8d to
5a57d5b
Compare
fnando
force-pushed
the
conceal-secrets-in-contract-invoke-usage
branch
from
October 20, 2026 00:33
5a57d5b to
65e0fcf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
stellar contract invoke/deploybuilt the clap command name from the full pre---command line, so--helpand any usage error echoed--source,--sign-with-key,--rpc-header, and--rpc-urlsecrets verbatim to stdout. The usage line is now built from the known command path alone:<program> contract invoke|deploy [OPTIONS] --, where<program>is the running binary and the subcommand is supplied by the caller.Why
Secrets passed on the command line leaked into scrollback, CI logs, and pasted reports. The project already conceals these values from the environment and in account/contract-id lookups; this closes the same leak on the invoke/deploy help path.
No user-supplied argv token reaches the usage line, so it is secret-free by construction — rather than trying to classify and scrub each argv token, which is unwinnable across clap's
--flag value,--flag=value,-sVALUE,-s=VALUE, and stacked-vsVALUEforms. Deriving the path from the caller (not argv) also renders correctly when global flags such as--quietor--config-dirprecede the subcommand.