chore: build and security hygiene - #2421
Conversation
- Align AGENTS.md with Java 17 bytecode and PR title guidelines - Update libs.versions.toml with room, ktor, and serialization plugins - Add check_api_key.gradle.kts build validation script - Remove redundant kotlin-android plugin application in tutorials
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
6c5118b to
4fa4d5d
Compare
|
|
||
| // Check for relevant key names (e.g., MAPS_API_KEY or MAPS3D_API_KEY) | ||
| val apiKey = secrets.getProperty("MAPS_API_KEY") ?: secrets.getProperty("MAPS3D_API_KEY") ?: "" | ||
| println("Checking API Key in secrets.properties: '$apiKey'") |
There was a problem hiding this comment.
Plaintext api key printed to build logs
Risk: Anyone running a build locally with Gradle Build Scans (--scan), sharing terminal output in an issue, or running on a self-hosted runner without CI=true will leak their live Google Maps API key in plaintext logs.
Also missing .trim(), Copy-pasted keys in secrets.properties frequently have trailing whitespace or newlines, which causes apiKey.matches(Regex("^AIza[a-zA-Z0-9_-]{35}$")) on line 106 to fail unexpectedly.
Suggestion:
val apiKey = (secrets.getProperty("MAPS_API_KEY") ?: secrets.getProperty("MAPS3D_API_KEY") ?: "").trim()
val maskedKey = if (apiKey.length > 8) "${apiKey.take(4)}...${apiKey.takeLast(4)}" else "****"
println("Checking API Key in secrets.properties: '$maskedKey'")
Please correct me if my observation is wrong ?
3 participants
Summary
Reviewer
@LoyalAbbas