util: fix stripSecret re-appending the secret it redacted

[somanchi004-code]

Describe what this PR does

stripSecret cuts the argument on secret= and computes the end of the secret as an offset into the remainder, but then slices the original argument by that offset:

before, after, ok := strings.Cut(arg, secretArg)
end := strings.IndexByte(after, optionsArgSeparator)   // offset into `after`
out[i] = before + strippedSecret
if end != -1 {
    out[i] += arg[end+len(secretArg):]                 // ...but slices `arg`
}

The two coordinate systems only agree when secret= starts the argument. Any option before it shifts the tail and copies part of the secret back into the string that was just redacted.

Is there anything that requires special attention?

Yes — the longer the prefix, the more leaks, and a realistic mount option string leaks the whole key.

Running the current stripSecret over three inputs:

secret first            -> secret=***stripped***,mds_namespace=abc
secret after an option  -> name=admin,secret=***stripped***ersecretkey,mds_namespace=abc
long prefix             -> mon_addr=10.0.0.1:6789/10.0.0.2:6789,secret=***stripped***.0.1:6789/10.0.0.2:6789,secret=AQtiny,mds_namespace=abc

In the third case the literal text secret=AQtiny appears inside the supposedly-redacted output. A real mon_addr=... prefix runs well over 60 characters while a Ceph key is around 40, so the offset overshoots and the entire key is reproduced.

InArgs exists solely to redact secrets before logging, and ExecCommand logs the sanitized arguments on the success path too (internal/util/cephcmds.go), so this is every invocation rather than only failures.

After the change, all three redact correctly and no secret material survives.

The trigger is secret= not being first in its argv element. The kernel mounter builds mon_addr=...,secretfile=..., which contains no secret= substring, but it then appends admin-supplied kernelMountOptions (a documented StorageClass field), and secret= is a valid mount.ceph option.

This package had no test file. The new one covers a secret that is first, preceded by another option, preceded by a prefix longer than itself, last, and absent. It fails without the fix:

--- FAIL: TestInArgsStripsSecret/prefix_longer_than_the_secret
     got: ["-o" "mon_addr=...,secret=***stripped***.0.1:6789/10.0.0.2:6789,secret=AQtiny,mds_namespace=abc"]
    want: ["-o" "mon_addr=...,secret=***stripped***,mds_namespace=abc"]
    stripsecrets_test.go:65: secret material leaked into stripped output

and passes with it.

The line dates to the file's original commit in February 2019 and was carried through the strings.Index → strings.Cut refactor unchanged.

I searched open and closed issues and PRs for stripsecrets, stripSecret, strip secret, secret leak log and sanitize args, and checked the open PR list for anything touching this file — I did not find a duplicate, but please close this if I missed one.

Checklist

• Commit Message Formatting: Commit titles and messages follow guidelines in the developer guide
• Reviewed the developer guide on Submitting a Pull Request
• Pending release notes updated with breaking and/or notable changes for the next major release
• Documentation has been updated, if necessary.
• Unit tests have been added, if necessary.
• Integration tests have been added, if necessary.

[nixpanic]

Thanks for the PR, @somanchi004-code! This looks good to me, just a small request.

Could you please correct the date in the new file? And maybe consider adding test-cases for stripKey() as well?

Pull request has been modified.

[iPraveenParihar]

LGTM, @somanchi004-code can you squash your commits into one and we are good to merge?

[somanchi004-code]

LGTM, @somanchi004-code can you squash your commits into one and we are good to merge?

Squashed into one commit and rebased on devel, thanks.

[nixpanic]

/queue

[ceph-csi-bot]

/test ci/centos/k8s-e2e-external-storage/1.34

[ceph-csi-bot]

/test ci/centos/upgrade-tests-cephfs

[ceph-csi-bot]

/test ci/centos/mini-e2e-helm/k8s-1.34

[ceph-csi-bot]

/test ci/centos/upgrade-tests-rbd

[ceph-csi-bot]

/test ci/centos/mini-e2e/k8s-1.34

[ceph-csi-bot]

/test ci/centos/k8s-e2e-external-storage/1.35

[ceph-csi-bot]

/test ci/centos/mini-e2e-helm/k8s-1.35

[ceph-csi-bot]

/test ci/centos/mini-e2e/k8s-1.35

[ceph-csi-bot]

/test ci/centos/k8s-e2e-external-storage/1.36

[ceph-csi-bot]

/test ci/centos/mini-e2e-helm/k8s-1.36

[ceph-csi-bot]

/test ci/centos/mini-e2e/k8s-1.36

[nixpanic]

/retest ci/centos/mini-e2e/k8s-1.36

[nixpanic]

/retest ci/centos/mini-e2e/k8s-1.34

[nixpanic]

/retest ci/centos/mini-e2e-helm/k8s-1.34

[mergify]

Deprecation notice: This pull request comes from a fork and was queued with update_method=rebase and update_bot_account impersonation. This capability will be removed on July 1, 2026. After this date, the merge queue will no longer be able to rebase fork pull requests with this configuration. To avoid disruption, switch to update_method=merge in your queue rule.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-05 18:41 UTC · Rule: default · triggered by merge protections
• ✅ Checks passed · in-place
• ✅ Merged — 2026-08-06 08:13 UTC · at 5ea7f2712b3beb4ea37d3cc875f97737716adda8 · rebase

This pull request spent 13 hours 31 minutes 52 seconds in the queue, including 13 hours 30 minutes 55 seconds running CI.

Required conditions to merge

• github-review-approved [🛡 GitHub branch protection]
  • util: fix stripSecret re-appending the secret it redacted #6444

[ceph-csi-bot]

/test ci/centos/k8s-e2e-external-storage/1.34

[ceph-csi-bot]

/test ci/centos/mini-e2e-helm/k8s-1.34

[ceph-csi-bot]

/test ci/centos/k8s-e2e-external-storage/1.36

[ceph-csi-bot]

/test ci/centos/mini-e2e/k8s-1.34

[ceph-csi-bot]

/test ci/centos/mini-e2e-helm/k8s-1.36

[ceph-csi-bot]

/test ci/centos/mini-e2e/k8s-1.36

[ceph-csi-bot]

/test ci/centos/k8s-e2e-external-storage/1.35

[ceph-csi-bot]

/test ci/centos/mini-e2e-helm/k8s-1.35

[ceph-csi-bot]

/test ci/centos/mini-e2e/k8s-1.35

[ceph-csi-bot]

/test ci/centos/upgrade-tests-cephfs

[ceph-csi-bot]

/test ci/centos/upgrade-tests-rbd