Fix redacting sensitive values that uses backslashes hashicorp#737

helm/resource_release.go

@@ -875,20 +875,43 @@ func cloakSetValues(config map[string]interface{}, d resourceGetter) {
 
 const sensitiveContentValue = "(sensitive value)"
 
+func tokenizeCloakElements(valuePath string) []string {
+	var res []string
+	beginSubstr, endSubstr := 0, 0
+
+	for idx := range valuePath {
+		if (valuePath[idx] == '.') && (idx > 0) {
+			if valuePath[idx-1] != '\\' {
+				res = append(res, valuePath[beginSubstr:endSubstr])
+				beginSubstr = endSubstr + 1
+			}
+		}
+		endSubstr++
+	}
+
+	if endSubstr-beginSubstr > 0 {
+		res = append(res, valuePath[beginSubstr:])
+	}
+
+	return res
+}
+
 func cloakSetValue(values map[string]interface{}, valuePath string) {
-	pathKeys := strings.Split(valuePath, ".")
+	pathKeys := tokenizeCloakElements(valuePath)
 	sensitiveKey := pathKeys[len(pathKeys)-1]
 	parentPathKeys := pathKeys[:len(pathKeys)-1]
 
 	m := values
 	for _, key := range parentPathKeys {
+		key = strings.ReplaceAll(key, "\\", "")
 		v, ok := m[key].(map[string]interface{})
 		if !ok {
 			return
 		}
 		m = v
 	}
 
+	sensitiveKey = strings.ReplaceAll(sensitiveKey, "\\", "")
 	m[sensitiveKey] = sensitiveContentValue
 }
 

helm/resource_release_test.go

@@ -750,14 +750,14 @@ func TestCloakSetValues(t *testing.T) {
 func TestCloakSetValuesNested(t *testing.T) {
 	d := resourceRelease().Data(nil)
 	err := d.Set("set_sensitive", []interface{}{
-		map[string]interface{}{"name": "foo.qux.bar", "value": "42"},
+		map[string]interface{}{"name": "foo.qux.bar\\.nested", "value": "42"},
 	})
 	if err != nil {
 		t.Fatalf("error setting values: %v", err)
 	}
 
 	qux := map[string]interface{}{
-		"bar": "bar",
+		"bar.nested": "bar",
 	}
 
 	values := map[string]interface{}{
@@ -767,8 +767,8 @@ func TestCloakSetValuesNested(t *testing.T) {
 	}
 
 	cloakSetValues(values, d)
-	if qux["bar"] != sensitiveContentValue {
-		t.Fatalf("error cloak values, expected %q, got %s", sensitiveContentValue, qux["bar"])
+	if qux["bar.nested"] != sensitiveContentValue {
+		t.Fatalf("error cloak values, expected %q, got %s", sensitiveContentValue, qux["bar.nested"])
 	}
 }