kv2/metadata: `ReadSecretPathsAsync` allows empty path value to list all secrets on the `mountPoint` #337

konidev20 · 2023-11-22T19:00:27Z

In the implementation of

public async Task<Secret<ListInfo>> ReadSecretPathsAsync(string path, string mountPoint = null, string wrapTimeToLive = null)

the path is required which was built referencing -> https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#list-secrets

However, as reported in gh-334, it seems like path can be empty, if you want to list all the secrets on the mount point.

I tried this with Vault v1.15.2, below are the results of my test.

Sample Request

curl --header "X-Vault-Token: …” --request LIST http://127.0.0.1:8200/v1/secret/metadata

Response

{
  "request_id": "34a153dc-0fef-b717-25da-1f54e77ab581",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 0,
  "data": {
    "keys": [
      "bye",
      "hello/",
      "world"
    ]
  },
  "wrap_info": null,
  "warnings": null,
  "auth": null
}

considering the above results, I felt removing the strict null check and adding a simple guard rail would be a better solution.

fixes #334

the path is required in the API documentation of vault but if you manually run the API like curl --header "X-Vault-Token: …” --request LIST http://127.0.0.1:8200/v1/secret/metadata it would work therefore, removing the strict null check and adding a simple guard rail

konidev20 added 2 commits November 23, 2023 00:22

update IKeyValueSecretsEngineV2 documentation

f0c6cb6

konidev20 changed the title ~~remove null check for path, in list secrets API~~ ReadSecretPathsAsync allows empty path value to list all secrets on the mountPoint Nov 22, 2023

konidev20 changed the title ~~ReadSecretPathsAsync allows empty path value to list all secrets on the mountPoint~~ kv2/metadata: ReadSecretPathsAsync allows empty path value to list all secrets on the mountPoint Nov 22, 2023

update CHANGELOG.md

1f06f00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

kv2/metadata: `ReadSecretPathsAsync` allows empty path value to list all secrets on the `mountPoint` #337

kv2/metadata: `ReadSecretPathsAsync` allows empty path value to list all secrets on the `mountPoint` #337

konidev20 commented Nov 22, 2023 •

edited

kv2/metadata: ReadSecretPathsAsync allows empty path value to list all secrets on the mountPoint #337

Are you sure you want to change the base?

kv2/metadata: ReadSecretPathsAsync allows empty path value to list all secrets on the mountPoint #337

Conversation

konidev20 commented Nov 22, 2023 • edited

kv2/metadata: `ReadSecretPathsAsync` allows empty path value to list all secrets on the `mountPoint` #337

kv2/metadata: `ReadSecretPathsAsync` allows empty path value to list all secrets on the `mountPoint` #337

konidev20 commented Nov 22, 2023 •

edited