Some sub-commands (`config` for example) can output secrets (passwords)

[Klaim]

We have a test that expects the output of mamba config ... to show a password:

mamba/micromamba/tests/test_config.py

Line 796 in c527708

def test_envsubst_windows_problem(self, monkeypatch, rc_file):

This test fails in my PR because in it --json leads to usage of the hide_secrets function on the output.

I first attempted to disable hiding secrets in config output, but having a doubt I checked with @JohanMabille and we agree that the test is wrong and the password should never be visible with or without --json (normal output is in the YAML format).

I'm creating this issue so that we can discuss the most correct and expected output.
What do you think? @AntoinePrv @jjerphan @Hind-M

Note: I intend to make a pr for this if we agree. It's easier to fix in my pr but it's kind of unrelated to --json.

[jjerphan]

I think you are right hiding password of the output of mamba config ..., be it JSON or not.

[Klaim]

Side question: We also have some other output that are dumped without any filtering, although if I searched correctly they dont seem to output secrets... should I still add filters in case of future changes?

[Klaim]

I think you are right hiding password of the output of mamba config ..., be it JSON or not.

Do you know of any cases with conda where it is expected that the output is not filtered for secrets?

[Hind-M]

Side question: We also have some other output that are dumped without any filtering, although if I searched correctly they dont seem to output secrets... should I still add filters in case of future changes?

IIRC, there were issues when filtering everything (a seg fault or something), but yes we should do that whenever possible.

[Klaim]

Side question: We also have some other output that are dumped without any filtering, although if I searched correctly they dont seem to output secrets... should I still add filters in case of future changes?

IIRC, there were issues when filtering everything (a seg fault or something), but yes we should do that whenever possible.

I remember crashes in the hide_secret function at some point but didnt know if it was because we were trying to use it everywhere. I can try to fix anything I see while attempting that then, ok 👍🏽

[Klaim]

I spotted many direct use of the standard outputs, I'll make separate PRs, this first one is to unlock my PRs by fixing the config output case.