Secret object parameters in the CLI and Web are no longer redacted

[jjm]

SUMMARY

Following an upgrade to ST2 2.8.0, I found parameters with an type of object and marked as secret: true were not being redacted for both the WebUI and CLI.

ISSUE TYPE

• Bug Report

STACKSTORM VERSION

st2 2.8.0, on Python 2.7.6

OS / ENVIRONMENT / INSTALL METHOD

docker via st2-docker.

STEPS TO REPRODUCE

Have an action (e.g. aws_boto3.boto3action) that takes an object as a parameter and marked as secret: true.

When running the action with the following parameters :

parameters:
  region:
    type: "string"
    description: "Region where action is performed"
    default: "eu-west-1"
  credentials:
    type: "object"
    description: "An AWS credentials object"
    secret: true

EXPECTED RESULTS

The secret parameter should be redacted, the following output is from v2.7.x:

parameters:
  credentials: '********'
  region: eu-west-1

ACTUAL RESULTS

id: 5b44b87390be8400f0b121b7
status: succeeded
parameters:
  credentials:
    Credentials:
      AccessKeyId: <deleted-non-redacted-key>
      Expiration: '2018-07-10 14:42:52'
      SecretAccessKey: <deleted-non-redacted-key>
      SessionToken: deleted-non-redacted-key
  region: eu-west-1
result:
  exit_code: 0
  result:
    allocation_ids: []
    no_association_ids: []
  stderr: ''
  stdout: ''

[jjm]

A little testing and the following simpler action configuration:

  credentials:
    type: "object"
    description: "Response from assume role"
    properties:
      AccessKeyId:
       type: string
       secret: true
      Expiration:
       type: string
      SecretAccessKey:
       type: string
       secret: true
      SessionToken:
       type: string
       secret: true

Produces the following output as expected:

id: 5b44c1ac90be8400f0b121c3
status: failed
parameters:
  credentials:
    AccessKeyId: '********'
    Expiration: '2018-07-10 14:42:52'
    SecretAccessKey: '********'
    SessionToken: '********'
  region: eu-west-1

Plus the following configuration:

  credentials:
    type: "object"
    description: "Response from assume role"
    properties:
      Credentials:
        type: "object"
        properties:
          AccessKeyId:
            type: string
            secret: true
          Expiration:
            type: string
          SecretAccessKey:
            type: string
            secret: true
          SessionToken:
            type: string
            secret: true

Produces what I would have expected:

d: 5b44c3b290be8400f0b121cc
status: succeeded
parameters:
  credentials:
    Credentials:
      AccessKeyId: '********'
      Expiration: '2018-07-10 14:42:52'
      SecretAccessKey: '********'
      SessionToken: '********'
  region: eu-west-1

[arm4b]

Fixed by #4236