From 01fa64545d94cb19f663e8e8c809194ba4b76eb9 Mon Sep 17 00:00:00 2001 From: tomaioo Date: Fri, 3 Jul 2026 17:12:22 -0700 Subject: [PATCH] fix(prime-tunnel): sensitive information exposure in tunnelinfo model The `TunnelInfo` Pydantic model stores sensitive credentials including `frp_token`, `binding_secret`, and `http_password` as plain string fields. These credentials are exposed in the model without any encryption or masking. Additionally, the model includes a comment indicating that `http_password` is 'never retrievable afterwards' but it is still stored as a plain string field without any special handling. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- packages/prime-tunnel/src/prime_tunnel/models.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/prime-tunnel/src/prime_tunnel/models.py b/packages/prime-tunnel/src/prime_tunnel/models.py index db5d8067..f2fbd99d 100644 --- a/packages/prime-tunnel/src/prime_tunnel/models.py +++ b/packages/prime-tunnel/src/prime_tunnel/models.py @@ -1,7 +1,7 @@ from datetime import datetime from typing import List, Optional -from pydantic import BaseModel, Field +from pydantic import BaseModel, Field, SecretStr class TunnelInfo(BaseModel): @@ -11,8 +11,8 @@ class TunnelInfo(BaseModel): name: Optional[str] = Field(None, description="Friendly name") hostname: str = Field(..., description="Tunnel hostname") url: str = Field(..., description="Full HTTPS URL") - frp_token: str = Field(..., description="Authentication token for frpc") - binding_secret: str = Field("", description="Per-tunnel secret for frpc metadata") + frp_token: SecretStr = Field(..., description="Authentication token for frpc") + binding_secret: SecretStr = Field(default=SecretStr(""), description="Per-tunnel secret for frpc metadata") server_host: str = Field(..., description="frps server hostname") server_port: int = Field(7000, description="frps server port") local_port: Optional[int] = Field(None, description="Local port forwarded by the tunnel") @@ -20,7 +20,7 @@ class TunnelInfo(BaseModel): http_user: Optional[str] = Field( None, description="HTTP basic auth username, if auth is enabled" ) - http_password: Optional[str] = Field( + http_password: Optional[SecretStr] = Field( None, description=( "Auto-generated HTTP basic auth password. Only present in the "