From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 2FF3861920 for ; Thu, 3 Dec 2020 09:48:01 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 1803F24A2E for ; Thu, 3 Dec 2020 09:47:31 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [212.186.127.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id E17E724A21 for ; Thu, 3 Dec 2020 09:47:29 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id AA933449DE for ; Thu, 3 Dec 2020 09:47:29 +0100 (CET) To: Proxmox VE development discussion , Dominik Csapak References: <20201202092113.15911-1-d.csapak@proxmox.com> <20201202092113.15911-2-d.csapak@proxmox.com> From: Thomas Lamprecht Cc: Wolfgang Bumiller Message-ID: Date: Thu, 3 Dec 2020 09:47:28 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:84.0) Gecko/20100101 Thunderbird/84.0 MIME-Version: 1.0 In-Reply-To: <20201202092113.15911-2-d.csapak@proxmox.com> Content-Type: text/plain; charset=UTF-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable X-SPAM-LEVEL: Spam detection results: 0 AWL -0.074 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment NICE_REPLY_A -0.001 Looks like a legit reply (A) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [tools.pm] Subject: Re: [pve-devel] [PATCH common 1/1] tools: add extract_sensitive_params X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Dec 2020 08:48:01 -0000 On 02.12.20 10:21, Dominik Csapak wrote: > moved and generalized from pve-storage, since we'll need it > in more places >=20 > Signed-off-by: Dominik Csapak > --- > src/PVE/Tools.pm | 24 ++++++++++++++++++++++++ > 1 file changed, 24 insertions(+) >=20 > diff --git a/src/PVE/Tools.pm b/src/PVE/Tools.pm > index 4b445ea..bda236a 100644 > --- a/src/PVE/Tools.pm > +++ b/src/PVE/Tools.pm > @@ -48,6 +48,7 @@ template_replace > safe_print > trim > extract_param > +extract_sensitive_params > file_copy > get_host_arch > O_PATH > @@ -807,6 +808,29 @@ sub extract_param { > return $res; > } > =20 can we have some short comment about what this does and when/why it can b= e useful here > +sub extract_sensitive_params :prototype($$$) { > + my ($param, $sensitive_list, $delete_list) =3D @_; > + > + my $sensitive; I know auto vivification and such things exist, but I'd feel more comfort= able to set above explicitly to and empty hash {} . > + > + my %delete =3D map { $_ =3D> 1 } ($delete_list || [])->@*; > + > + # always extract sensitive keys, so they don't get written to the = www-data readable scfg not only for scfg anymore, would drop that comment actually completely, t= hat's rather something for a method comment (see above) > + for my $opt (@$sensitive_list) { > + # First handle deletions as explicitly setting `undef`, afterwards ne= w values may override > + # it. I know this is just copied, but there's no actual reason for setting to u= ndef vs. using delete encoded in that comment, it's just merely describing what on= e sees when reading the code anyhow.. @Wolfgang, you as original author (pve-storage commit 72385de9e23df) why = did you used undef vs. delete? > + if (exists($delete{$opt})) { > + $sensitive->{$opt} =3D undef; > + } > + > + if (defined(my $value =3D extract_param($param, $opt))) { > + $sensitive->{$opt} =3D $value; > + } > + } > + > + return $sensitive; > +} > + > # Note: we use this to wait until vncterm/spiceterm is ready > sub wait_for_vnc_port { > my ($port, $family, $timeout) =3D @_; >=20