Skip to content

Commit e605b12

Browse files
lukekarrysnlf
authored andcommitted
fix: redact all private keys from config output
PR-URL: #4142 Credit: @lukekarrys Close: #4142 Reviewed-by: @wraithgar
1 parent 9e9a76a commit e605b12

File tree

3 files changed

+20
-3
lines changed

3 files changed

+20
-3
lines changed

lib/commands/config.js

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,17 @@ const keyValues = args => {
2828
return kv
2929
}
3030

31-
const publicVar = k => !/^(\/\/[^:]+:)?_/.test(k)
31+
const publicVar = k => {
32+
// _password
33+
if (k.startsWith('_')) {
34+
return false
35+
}
36+
// //localhost:8080/:_password
37+
if (k.startsWith('//') && k.includes(':_')) {
38+
return false
39+
}
40+
return true
41+
}
3242

3343
const BaseCommand = require('../base-command.js')
3444
class Config extends BaseCommand {
@@ -147,7 +157,7 @@ class Config extends BaseCommand {
147157
const out = []
148158
for (const key of keys) {
149159
if (!publicVar(key)) {
150-
throw `The ${key} option is protected, and cannot be retrieved in this way`
160+
throw new Error(`The ${key} option is protected, and cannot be retrieved in this way`)
151161
}
152162

153163
const pref = keys.length > 1 ? `${key}=` : ''

lib/utils/exit-handler.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,7 @@ const exitHandler = err => {
116116
exitCode = err.code
117117
noLogMessage = true
118118
} else if (typeof err === 'string') {
119+
// XXX: we should stop throwing strings
119120
log.error('', err)
120121
noLogMessage = true
121122
} else if (!(err instanceof Error)) {

test/lib/commands/config.js

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -333,7 +333,13 @@ t.test('config get private key', async t => {
333333

334334
await t.rejects(
335335
sandbox.run('config', ['get', '_authToken']),
336-
'_authToken is protected',
336+
/_authToken option is protected/,
337+
'rejects with protected string'
338+
)
339+
340+
await t.rejects(
341+
sandbox.run('config', ['get', '//localhost:8080/:_password']),
342+
/_password option is protected/,
337343
'rejects with protected string'
338344
)
339345
})

0 commit comments

Comments
 (0)