fix(serverless): fully redact secrets and remove startup import cycle

Author: justinwlin

runpod/_health/__init__.py

@@ -1 +1,20 @@
-"""Worker health checks independent of the serverless import tree."""
+"""Worker-process identity shared by startup and health checks."""
+
+import os
+import sys
+
+# Launchers may set this to the PID of the Python handler process before exec.
+# A generic container-level boolean would also authorize unrelated processes.
+WORKER_PID_ENV = "RUNPOD_FITNESS_WORKER_PID"
+
+
+def is_worker_process() -> bool:
+    """Require explicit launcher identity and exclude local/API test invocations."""
+    return (
+        os.environ.get(WORKER_PID_ENV) == str(os.getpid())
+        and bool(os.environ.get("RUNPOD_WEBHOOK_GET_JOB"))
+        and not any(
+            arg.split("=", 1)[0] in ("--test_input", "--rp_serve_api")
+            for arg in sys.argv[1:]
+        )
+    )

runpod/_health/fitness.py

@@ -20,7 +20,7 @@
 from collections.abc import Callable
 
 from runpod._logger import RunPodLogger
-from runpod._startup import is_worker_process
+from . import is_worker_process
 
 log = RunPodLogger()
 

runpod/_logger.py

@@ -110,13 +110,11 @@ def log(self, message, message_level="INFO", job_id=None):
         return
 
     def secret(self, secret_name, secret):
-        """
-        Censors secrets for logging.
-        Replaces everything except the first and last characters with *
-        """
-        secret = str(secret)
-        redacted_secret = secret[0] + "*" * (len(secret) - 2) + secret[-1]
-        self.info(f"{secret_name}: {redacted_secret}")
+        """Log the secret's name without exposing its value or length."""
+        # Even a one-character value must be completely redacted. Do not call
+        # str(secret): custom objects may reveal sensitive data or raise.
+        self.info(f"{secret_name}: [REDACTED]")
+
 
     def debug(self, message, request_id: Optional[str] = None):
         """

runpod/_startup.py

@@ -1,23 +1,10 @@
 """Process-scoped startup gate; safe to import without loading serverless."""
 
-import os
 import sys
 
-# Launchers may set this to the PID of the Python handler process before exec.
-# A generic container-level boolean would also authorize unrelated processes.
-WORKER_PID_ENV = "RUNPOD_FITNESS_WORKER_PID"
+from ._health import WORKER_PID_ENV, is_worker_process
 
-
-def is_worker_process() -> bool:
-    """Require explicit launcher identity and exclude local/API test invocations."""
-    return (
-        os.environ.get(WORKER_PID_ENV) == str(os.getpid())
-        and bool(os.environ.get("RUNPOD_WEBHOOK_GET_JOB"))
-        and not any(
-            arg.split("=", 1)[0] in ("--test_input", "--rp_serve_api")
-            for arg in sys.argv[1:]
-        )
-    )
+__all__ = ["WORKER_PID_ENV", "is_worker_process", "run_import_checks"]
 
 
 def run_import_checks() -> None:

tests/test_serverless/test_modules/test_logger.py

@@ -105,9 +105,20 @@ def test_log_secret(self):
         with patch("runpod.serverless.modules.rp_logger.RunPodLogger.log") as mock_log:
             self.logger.secret("test_secret", "test_secret_value")
             mock_log.assert_called_once_with(
-                "test_secret: t***************e", "INFO", None
+                "test_secret: [REDACTED]", "INFO", None
             )
 
+    def test_secret_redacts_short_empty_and_object_values(self):
+        class Sensitive:
+            def __str__(self):
+                raise AssertionError("A secret must not be converted to text")
+
+        for value in ("", "a", "ab", "long-secret", None, Sensitive()):
+            with self.subTest(value_type=type(value).__name__):
+                with patch.object(self.logger, "log") as mock_log:
+                    self.logger.secret("credential", value)
+                    mock_log.assert_called_once_with("credential: [REDACTED]", "INFO", None)
+
     def test_log_tip(self):
         """
         Tests that the tip method logs a tip.