Empty secret places ******** between every character

Using any simple drone.yml, such as:

kind: pipeline
name: default

- name: Hello World
  image: "alpine:3.8"
  - echo "Hello World"

And a secret.txt file with an empty secret such as:


The output for the following command is virtually unreadable:
drone exec --secret-file="secret.txt" --trusted

The problem is the replace rules prepared for writing lines, which adds a rule to replace nothing with ********, resulting in ******** being inserted after every character of output. An empty string check in the newReplacer function at the end of https://github.com/drone/drone-runtime/blob/master/runtime/line.go would presumably fix the problem.

great catch, would you consider sending a PR to drone-runtime? or opening an issue so that we can track? Thanks!

I’m not much of a Go dev and don’t have a dev environment for drone set up at the moment to be able to adequately test any patch. I’m happy to set up the issue though. The only reason I started here is because your GitHub repo is configured to tell people NOT to post bugs there.

thanks, got it. I’ll make sure it gets addressed in the coming weeks.

yes, I appreciate you posting here first … we get a lot of false positive issues :slight_smile: