I was the reporter on this one. If you have Github Actions in your organization, disable them immediately if you're unsure which version of composer your Github Actions run.
> GitHub Actions' built-in secret masker matches registered values as exact substrings. When the exception message is rendered by Symfony Console it may wrap, embed in In BaseIO.php line N: framing, or interleave with ANSI control sequences. So the masker does not redact, and the plaintext token reaches the log.
What does this log rendering look like such that the token from that code snippet becomes interleaved enough to not be a substring match?
I'm not familiar with composer/Symfony but I would expect something like:
Line 34: Foo bar
Line 34: <red>Foo bar</red>For your example:
Line 34: <red>ghs_fdsafdsarewqfdsa...</red>
Is probably long enough in most cases to break to a new line.
Also, those blocks get "interleaved" like this:
<red>ghs_fdsafdsarewqfdsafdsa</red>
<red>fdsardsardsafdsafs......</red>
So there are now </red>'s within the token, also breaking the substring matching.
This is kind of eye-opening for me -- I have never thought about how styled output like this could cause logging leakages.
How many other actions/libraries do you think are vulnerable?
This include's the GITHUB_TOKEN that is builtin within a actions jobs.