Sensitive properties of custom resources leaked via failed regex constraints

[chuhn]

Description

When a custom resource has a property that is flagged as sensitive and guarded by a regex its content will be printed to STDOUT if it does not match the given regex.

Chef Version

Cinc Client: 18.2.7

Platform Version

Debian 11

Replication Case

Define a custom resource with:

property :my_property, String, sensitive: true, regex: %r{^foobar$}

Call that resource with my_property set to something other than foobar.

Client Output

FATAL: Chef::Exceptions::ValidationFailed: Property my_property's value SuperSecretPassword does not match regular expression /^foobar$/