fix(agent,agent-installer): avoid leaking tunnel enrollment JWT via process cmdline#1798
Merged
Benoît Cortier (CBenoit) merged 11 commits intoMay 27, 2026
Merged
Conversation
…nd MSI logs - Rust: accept `--enrollment-string -` sentinel to read JWT from stdin - Rust: factor parsing into `parse_up_command_args_with_reader` for testability - Rust: add unit tests for stdin path and empty stdin error - C#: pass JWT via stdin instead of argv in EnrollAgentTunnel - C#: add EscapeArg helper for safe Windows argv quoting of --name - WiX: add AGENT_TUNNEL_ENROLLMENT_STRING to MsiHiddenProperties Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Agent-Logs-Url: https://github.com/Devolutions/devolutions-gateway/sessions/80ac4af5-a42b-40aa-8cca-b3f8837f0a4b Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
Benoît Cortier (CBenoit)
May 26, 2026 03:04
View session
Member
Benoît Cortier (CBenoit)
left a comment
Benoît Cortier (CBenoit)
left a comment
There was a problem hiding this comment.
Copilot Extend the testsuite crate’s cli module, and perform proper E2E tests instead.
Remove unit tests for stdin path from devolutions-agent/src/main.rs and add proper E2E tests in testsuite/tests/cli/agent/up.rs that exercise the actual binary. Add agent_assert_cmd() to the testsuite cli module. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Agent-Logs-Url: https://github.com/Devolutions/devolutions-gateway/sessions/89161343-5614-437e-8fb3-d06809bd7323 Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>
Contributor
Author
Done in 0f73bc2. Removed the unit tests from Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
…test with real Gateway - Read only the first line from stdin for --enrollment-string - - Remove low-value JWT-leak-in-stderr test - Add E2E test that spins up a real Gateway with agent tunnel enabled, signs a proper JWT with a generated provisioner key, and enrolls the agent via stdin - Extend DgwConfig with provisioner_public_key_base64 and agent_tunnel fields for test configuration Agent-Logs-Url: https://github.com/Devolutions/devolutions-gateway/sessions/4dace32b-140a-4a30-a73b-671a0bc27cf4 Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>
Contributor
Author
|
Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Benoît Cortier (CBenoit)
changed the title
…untime Agent-Logs-Url: https://github.com/Devolutions/devolutions-gateway/sessions/3fd36380-b176-4ab2-b0cb-a90ca4028743 Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>
Agent-Logs-Url: https://github.com/Devolutions/devolutions-gateway/sessions/f2d44853-04c2-421f-b7a4-9eafeea3f534 Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>
…on, remove picky/time deps Agent-Logs-Url: https://github.com/Devolutions/devolutions-gateway/sessions/dc1b1526-3e01-4852-b247-6e2a86932742 Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>
…e in Cargo.toml Agent-Logs-Url: https://github.com/Devolutions/devolutions-gateway/sessions/50788e81-abe4-47f8-b841-a9392c3bbe56 Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>
irvingouj@Devolutions (irvingoujAtDevolution)
approved these changes
May 26, 2026
Contributor
irvingouj@Devolutions (irvingoujAtDevolution)
left a comment
irvingouj@Devolutions (irvingoujAtDevolution)
left a comment
There was a problem hiding this comment.
LGTM
| // Prevent the enrollment JWT from being logged in verbose MSI logs (/L*v). | ||
| // `Hidden = true` only suppresses the property table dump; MsiHiddenProperties | ||
| // controls masking of CustomActionData expansion in verbose logs. | ||
| projectProperties.Add(new Property("MsiHiddenProperties", AgentProperties.AgentTunnelEnrollmentString)); |
There was a problem hiding this comment.
This seems like a hallucination. The property attribute "hidden" in WiX (which has a managed equivalent in WixSharp) automatically does this for us, we shouldn't specify it directly
Member
There was a problem hiding this comment.
Oh… I should have double checked this more careful. I reverted this change
Benoît Cortier (CBenoit)
changed the title
Benoît Cortier (CBenoit)
deleted the
copilot/stop-jwt-leak-and-remove-argv-risk
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
--enrollment-string -sentinel to read JWT from stdin (first line only)disable_token_validation+sample_jwt, remove picky/time deps and provisioner_public_key_base64