From d5e017d21cccd0da5ce015d37263f868ea0fd1c7 Mon Sep 17 00:00:00 2001 From: Brian Spector <2736922+spector-in-london@users.noreply.github.com> Date: Mon, 27 Jul 2026 10:34:18 -0500 Subject: [PATCH] fix(cli): hide secret environment values in help --- crates/buzz-cli/src/lib.rs | 4 ++-- crates/buzz-cli/tests/help_redaction.rs | 22 ++++++++++++++++++++++ 2 files changed, 24 insertions(+), 2 deletions(-) create mode 100644 crates/buzz-cli/tests/help_redaction.rs diff --git a/crates/buzz-cli/src/lib.rs b/crates/buzz-cli/src/lib.rs index 6ab81a082d..000c8efc05 100644 --- a/crates/buzz-cli/src/lib.rs +++ b/crates/buzz-cli/src/lib.rs @@ -82,11 +82,11 @@ struct Cli { relay: String, /// Nostr private key (hex or nsec). This is the CLI's identity. - #[arg(long, env = "BUZZ_PRIVATE_KEY")] + #[arg(long, env = "BUZZ_PRIVATE_KEY", hide_env_values = true)] private_key: Option, /// NIP-OA auth tag JSON (owner attestation). Injected into every signed event. - #[arg(long, env = "BUZZ_AUTH_TAG")] + #[arg(long, env = "BUZZ_AUTH_TAG", hide_env_values = true)] auth_tag: Option, /// Output format: 'json' (default, full fields) or 'compact' (reduced fields). diff --git a/crates/buzz-cli/tests/help_redaction.rs b/crates/buzz-cli/tests/help_redaction.rs new file mode 100644 index 0000000000..fb461da088 --- /dev/null +++ b/crates/buzz-cli/tests/help_redaction.rs @@ -0,0 +1,22 @@ +use std::process::Command; + +#[test] +fn help_hides_secret_environment_values() { + let private_key_sentinel = "private-key-value-must-not-appear"; + let auth_tag_sentinel = "auth-tag-value-must-not-appear"; + + let output = Command::new(env!("CARGO_BIN_EXE_buzz")) + .arg("--help") + .env("BUZZ_PRIVATE_KEY", private_key_sentinel) + .env("BUZZ_AUTH_TAG", auth_tag_sentinel) + .output() + .expect("run buzz --help"); + + assert!(output.status.success()); + let stdout = String::from_utf8(output.stdout).expect("help output is UTF-8"); + + assert!(stdout.contains("[env: BUZZ_PRIVATE_KEY]")); + assert!(stdout.contains("[env: BUZZ_AUTH_TAG]")); + assert!(!stdout.contains(private_key_sentinel)); + assert!(!stdout.contains(auth_tag_sentinel)); +}