Skip to content

Commit 0a7cf5a

Browse files
authored
Document Resource options that potentially leak secrets (#2727)
The WithProcess and WithProcessCommandArgs options contain command line arguments as resource attributes. These could potentially expose user secrets. Document this fact so users better understand the implications of using these options.
1 parent 7a1ebf7 commit 0a7cf5a

File tree

1 file changed

+15
-2
lines changed

1 file changed

+15
-2
lines changed

sdk/resource/config.go

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,16 @@ func WithOSDescription() Option {
110110
}
111111

112112
// WithProcess adds all the Process attributes to the configured Resource.
113-
// See individual WithProcess* functions to configure specific attributes.
113+
//
114+
// Warning! This option will include process command line arguments. If these
115+
// contain sensitive information it will be included in the exported resource.
116+
//
117+
// This option is equivalent to calling WithProcessPID,
118+
// WithProcessExecutableName, WithProcessExecutablePath,
119+
// WithProcessCommandArgs, WithProcessOwner, WithProcessRuntimeName,
120+
// WithProcessRuntimeVersion, and WithProcessRuntimeDescription. See each
121+
// option function for information about what resource attributes each
122+
// includes.
114123
func WithProcess() Option {
115124
return WithDetectors(
116125
processPIDDetector{},
@@ -143,7 +152,11 @@ func WithProcessExecutablePath() Option {
143152
}
144153

145154
// WithProcessCommandArgs adds an attribute with all the command arguments (including
146-
// the command/executable itself) as received by the process the configured Resource.
155+
// the command/executable itself) as received by the process to the configured
156+
// Resource.
157+
//
158+
// Warning! This option will include process command line arguments. If these
159+
// contain sensitive information it will be included in the exported resource.
147160
func WithProcessCommandArgs() Option {
148161
return WithDetectors(processCommandArgsDetector{})
149162
}

0 commit comments

Comments
 (0)