Proper platform handle gitcreds #62
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,25 @@ | ||||||||||||||||||||||||||||||||
| #!/bin/false | ||||||||||||||||||||||||||||||||
| # shellcheck shell=bash | ||||||||||||||||||||||||||||||||
| # shellcheck disable=SC2154 | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| if [ -z "${GIT_PRIVATE_TOKEN}" ] | ||||||||||||||||||||||||||||||||
| then | ||||||||||||||||||||||||||||||||
| echo "GIT_PRIVATE_TOKEN unset skipping" | ||||||||||||||||||||||||||||||||
| else | ||||||||||||||||||||||||||||||||
| echo "GIT_PRIVATE_TOKEN is set configuring git credentials" | ||||||||||||||||||||||||||||||||
|
Comment on lines
+5
to
+9
There was a problem hiding this comment. 🛠️ Refactor suggestion Enhance security measures for token handling. While the script checks if the token is set, consider adding:
Consider adding basic validation: if [ -z "${GIT_PRIVATE_TOKEN}" ]
then
echo "GIT_PRIVATE_TOKEN unset skipping"
else
+ # Validate token format and length
+ if [[ ! "${GIT_PRIVATE_TOKEN}" =~ ^gh[ps]_[a-zA-Z0-9]{36,255}$ ]]; then
+ echo "Error: Invalid GitHub token format" >&2
+ exit 1
+ fi
echo "GIT_PRIVATE_TOKEN is set configuring git credentials"📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| git config --global credential.helper store | ||||||||||||||||||||||||||||||||
| git config --global --replace-all url."https://token:[email protected]/".insteadOf ssh://[email protected]/ | ||||||||||||||||||||||||||||||||
| git config --global --add url."https://token:[email protected]/".insteadOf [email protected] | ||||||||||||||||||||||||||||||||
| git config --global --add url."https://token:[email protected]/".insteadOf "https://github.com/" | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| git config --global url."https://ssh:[email protected]/".insteadOf "ssh://[email protected]/" | ||||||||||||||||||||||||||||||||
| git config --global url."https://git:[email protected]/".insteadOf "[email protected]:" | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
|
Comment on lines
+11
to
+18
There was a problem hiding this comment. Limit the scope of Git configurations and enhance security. Several security and scope concerns:
Consider these improvements: -git config --global credential.helper store
+# Use git credential cache instead of store
+git config credential.helper 'cache --timeout=3600'
-git config --global --replace-all url."https://token:[email protected]/".insteadOf ssh://[email protected]/
+# Scope configurations to the repository instead of global
+git config --replace-all url."https://token:[email protected]/".insteadOf ssh://[email protected]/Also, add a cleanup function: cleanup_git_config() {
git config --unset-all url."https://token:$GIT_PRIVATE_TOKEN@github.com/".insteadOf
git config --unset credential.helper
}
trap cleanup_git_config EXIT |
||||||||||||||||||||||||||||||||
| fi | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| echo "---------- git config --list -------------" | ||||||||||||||||||||||||||||||||
| git --no-pager config --list | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| echo "---------- git config --list --show-origin -------------" | ||||||||||||||||||||||||||||||||
| git --no-pager config --list --show-origin | ||||||||||||||||||||||||||||||||
|
Comment on lines
+1
to
+25
There was a problem hiding this comment. 💡 Codebase verification Cross-platform scripts exist but macOS version is empty The verification shows that:
🔗 Analysis chainVerify cross-platform consistency. Ensure similar scripts exist for other platforms (Windows/macOS) with consistent behavior. 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Check for similar scripts in other platform directories
echo "Checking for platform-specific scripts..."
fd -t f "set-gitcredential" src/scripts
# Compare script contents for consistency
echo -e "\nComparing script contents..."
for script in $(fd -t f "set-gitcredential" src/scripts); do
echo "=== $script ==="
cat "$script" | grep -E "credential.helper|url\."
done
Length of output: 3324
Comment on lines
+21
to
+25
There was a problem hiding this comment. 🛠️ Refactor suggestion Secure sensitive information in logs. The current configuration display might leak sensitive tokens in logs. Consider filtering sensitive information before display. Add filtering: echo "---------- git config --list -------------"
-git --no-pager config --list
+git --no-pager config --list | sed -e 's/\(url.*token:\)[^@]*\(@.*\)/\1[FILTERED]\2/'
echo "---------- git config --list --show-origin -------------"
-git --no-pager config --list --show-origin
+git --no-pager config --list --show-origin | sed -e 's/\(url.*token:\)[^@]*\(@.*\)/\1[FILTERED]\2/'📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||||||||||||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,25 @@ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| #!/bin/false | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # shellcheck shell=bash | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # shellcheck disable=SC2154 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+1
to
+4
There was a problem hiding this comment. Replace The current shebang points to -#!/bin/false
+#!/bin/bash📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| if [ -z "${GIT_PRIVATE_TOKEN}" ] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| then | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "GIT_PRIVATE_TOKEN unset skipping" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| else | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "GIT_PRIVATE_TOKEN is set configuring git credentials" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| git config --global credential.helper store | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| git config --global --replace-all url."https://token:[email protected]/".insteadOf ssh://[email protected]/ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| git config --global --add url."https://token:[email protected]/".insteadOf [email protected] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| git config --global --add url."https://token:[email protected]/".insteadOf "https://github.com/" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| git config --global url."https://ssh:[email protected]/".insteadOf "ssh://[email protected]/" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| git config --global url."https://git:[email protected]/".insteadOf "[email protected]:" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+11
to
+18
There was a problem hiding this comment. Critical: Address security vulnerabilities in Git credential handling Several security concerns need to be addressed:
Recommended changes:
-git config --global credential.helper store
+# Use macOS keychain for secure credential storage
+git config credential.helper osxkeychain
+
+# Configure for the specific repository instead of globally
+REPO_DIR="$(git rev-parse --git-dir 2>/dev/null)"
+if [ -z "$REPO_DIR" ]; then
+ echo >&2 "Error: Not in a git repository"
+ exit 1
+fi
+
+# Mask token in logs
+set +x
+
+# Use local config instead of global
-git config --global --replace-all url."https://token:[email protected]/".insteadOf ssh://[email protected]/
-git config --global --add url."https://token:[email protected]/".insteadOf [email protected]
-git config --global --add url."https://token:[email protected]/".insteadOf "https://github.com/"
-git config --global url."https://ssh:[email protected]/".insteadOf "ssh://[email protected]/"
-git config --global url."https://git:[email protected]/".insteadOf "[email protected]:"
+git config url."https://oauth2:[email protected]/".insteadOf ssh://[email protected]/
+git config --add url."https://oauth2:[email protected]/".insteadOf [email protected]
+git config --add url."https://oauth2:[email protected]/".insteadOf "https://github.com/"
+
+# Add cleanup trap
+trap 'git config --remove-section url' EXIT📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| fi | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "---------- git config --list -------------" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| git --no-pager config --list | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "---------- git config --list --show-origin -------------" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| git --no-pager config --list --show-origin | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+21
to
+25
There was a problem hiding this comment. Secure the configuration output to prevent token exposure The current implementation logs the entire Git configuration, which could expose the token in CI logs. -echo "---------- git config --list -------------"
-git --no-pager config --list
+echo "Verifying Git configuration (sensitive values masked)..."
+git --no-pager config --list | sed -E 's/(oauth2|token):[^@]+@/\1:***@/g'
-echo "---------- git config --list --show-origin -------------"
-git --no-pager config --list --show-origin
+echo "Configuration sources:"
+git --no-pager config --list --show-origin | sed -E 's/(oauth2|token):[^@]+@/\1:***@/g'📝 Committable suggestion
Suggested change
Comment on lines
+1
to
+25
There was a problem hiding this comment. 💡 Codebase verification Git credentials configuration needs attention for security Based on the verification results:
Recommendations:
🔗 Analysis chainVerify script integration with CI system and Unity Package Manager Please verify the following aspects:
🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Check script permissions and references in CI config
echo "Checking script permissions and CI configuration..."
fd -t f "set-gitcredential.sh" -x stat -f "%A %N"
# Look for Unity Package Manager configuration
echo "Checking Unity Package Manager configuration..."
fd -t f "manifest.json" -x cat {} \; | grep -A 5 "dependencies"
# Check for credential cleanup in CI workflows
echo "Checking credential cleanup in workflows..."
fd -t f -e yml -e yaml . | xargs grep -l "set-gitcredential"
Length of output: 663 Script: #!/bin/bash
# Check the content of prepare-env.yml to understand the script usage
echo "Checking prepare-env.yml content..."
cat src/commands/prepare-env.yml
# Try checking script permissions using ls instead of stat
echo "Checking script permissions..."
find . -name "set-gitcredential.sh" -exec ls -l {} \;
# Check for any cleanup or post-job steps in workflows
echo "Checking for cleanup steps..."
rg -A 5 "post-steps|post_build|cleanup" src/commands/prepare-env.yml
Length of output: 4440 Script: #!/bin/bash
# Check the main set-gitcredential.sh script to understand cleanup handling
echo "Checking main set-gitcredential.sh..."
cat src/scripts/set-gitcredential.sh
# Check if there are any post-job cleanup scripts
echo "Looking for cleanup scripts..."
rg -l "git.*config.*--unset|git.*config.*--remove-section"
# Check for any Unity package related configurations
echo "Checking Unity package configurations..."
find . -type f -name "*.json" -exec grep -l "packageManager\|registry" {} \;
Length of output: 1004 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,19 @@ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| #!/usr/bin/env bash | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # shellcheck disable=SC2034 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| readonly base_dir="${CIRCLE_WORKING_DIRECTORY/\~/$HOME}" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| readonly unity_project_full_path="$base_dir/$PARAM_PROJECT_PATH" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Import "utils.sh". | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| eval "$SCRIPT_UTILS" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+1
to
+8
There was a problem hiding this comment. 🛠️ Refactor suggestion Add error handling and strict mode for improved robustness The script setup needs additional safeguards to prevent potential issues: #!/usr/bin/env bash
-# shellcheck disable=SC2034
+# shellcheck disable=SC2034 # Justification: Variables are used in evaluated scripts
+
+set -euo pipefail # Exit on error, undefined vars, and pipe failures
+
+if [ -z "${CIRCLE_WORKING_DIRECTORY:-}" ] || [ -z "${PARAM_PROJECT_PATH:-}" ]; then
+ echo "Error: Required environment variables CIRCLE_WORKING_DIRECTORY and PARAM_PROJECT_PATH must be set"
+ exit 1
+fi
readonly base_dir="${CIRCLE_WORKING_DIRECTORY/\~/$HOME}"
readonly unity_project_full_path="$base_dir/$PARAM_PROJECT_PATH"
# Import "utils.sh".
+if ! eval "$SCRIPT_UTILS"; then
+ echo "Error: Failed to import utils.sh"
+ exit 1
+fi
-eval "$SCRIPT_UTILS"📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Detect host OS. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| detect-os | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Expand environment name variable parameters. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| readonly git_private_token="${!PARAM_GIT_PRIVATE_TOKEN}" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+10
to
+14
There was a problem hiding this comment. Enhance security for Git token handling The current token handling implementation needs additional security measures: # Detect host OS.
-detect-os
+if ! detect-os; then
+ echo "Error: Failed to detect operating system"
+ exit 1
+fi
# Expand environment name variable parameters.
+if [ -z "${PARAM_GIT_PRIVATE_TOKEN:-}" ]; then
+ echo "Error: PARAM_GIT_PRIVATE_TOKEN environment variable name must be set"
+ exit 1
+fi
+
readonly git_private_token="${!PARAM_GIT_PRIVATE_TOKEN}"
+
+if [ -z "$git_private_token" ]; then
+ echo "Error: Git private token cannot be empty"
+ exit 1
+fi
+
+# Mask token in debug output
+if [ "${BASH_VERBOSE:-}" = "true" ]; then
+ export PS4='+ $(date "+%Y-%m-%d %H:%M:%S") ${BASH_SOURCE##*/}:${LINENO}: '
+ set -x
+fi📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| if [ "$PLATFORM" = "linux" ]; then eval "$SCRIPT_GIT_CREDENTIAL_LINUX"; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| elif [ "$PLATFORM" = "macos" ]; then eval "$SCRIPT_GIT_CREDENTIAL_MACOS"; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| elif [ "$PLATFORM" = "windows" ]; then eval "$SCRIPT_GIT_CREDENTIAL_WINDOWS"; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| fi | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,53 @@ | ||||||||||||||||||||||
| #!/bin/false | ||||||||||||||||||||||
| # shellcheck shell=bash | ||||||||||||||||||||||
| # shellcheck disable=SC2016,SC2154 | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| readonly base_dir="${CIRCLE_WORKING_DIRECTORY/\~/$HOME}" | ||||||||||||||||||||||
| readonly unity_project_full_path="$base_dir/$PARAM_PROJECT_PATH" | ||||||||||||||||||||||
|
Comment on lines
+5
to
+6
There was a problem hiding this comment. 🛠️ Refactor suggestion Remove unused variable declaration The readonly base_dir="${CIRCLE_WORKING_DIRECTORY/\~/$HOME}"
-readonly unity_project_full_path="$base_dir/$PARAM_PROJECT_PATH"📝 Committable suggestion
Suggested change
🧰 Tools🪛 Shellcheck (0.9.0-1)[warning] 6-6: unity_project_full_path appears unused. Verify use (or export if used externally). (SC2034) |
||||||||||||||||||||||
|
|
||||||||||||||||||||||
| # Import "utils.sh". | ||||||||||||||||||||||
| eval "$SCRIPT_UTILS" | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| # Detect host OS. | ||||||||||||||||||||||
| detect-os | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| # Expand environment name variable parameters. | ||||||||||||||||||||||
| readonly git_private_token="${!PARAM_GIT_PRIVATE_TOKEN}" | ||||||||||||||||||||||
| readonly CONTAINER_NAME="${CIRCLE_PROJECT_REPONAME}-${CIRCLE_BUILD_NUM}" | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| trap_exit() { | ||||||||||||||||||||||
| local exit_status="$?" | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| if [ "$exit_status" -ne 0 ]; then | ||||||||||||||||||||||
| printf '%s\n' 'The script did not complete successfully.' | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| printf '%s\n' "Removing the container \"$CONTAINER_NAME\"." | ||||||||||||||||||||||
| docker rm -f "$CONTAINER_NAME" &> /dev/null || true | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| exit "$exit_status" | ||||||||||||||||||||||
| fi | ||||||||||||||||||||||
| } | ||||||||||||||||||||||
| trap trap_exit EXIT | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
|
|
||||||||||||||||||||||
| if [ -z "${git_private_token}" ] | ||||||||||||||||||||||
| then | ||||||||||||||||||||||
| echo "GIT_PRIVATE_TOKEN unset skipping" | ||||||||||||||||||||||
| else | ||||||||||||||||||||||
| echo "GIT_PRIVATE_TOKEN is set configuring git credentials" | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| docker exec "$CONTAINER_NAME" "git config --global credential.helper store" | ||||||||||||||||||||||
| docker exec "$CONTAINER_NAME" "git config --global --replace-all url.\"https://token:[email protected]/\".insteadOf ssh://[email protected]/" | ||||||||||||||||||||||
| docker exec "$CONTAINER_NAME" "git config --global --add url.\"https://token:[email protected]/\".insteadOf [email protected]" | ||||||||||||||||||||||
| docker exec "$CONTAINER_NAME" "git config --global --add url.\"https://token:[email protected]/\".insteadOf \"https://github.com/\"" | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| docker exec "$CONTAINER_NAME" "git config --global url.\"https://ssh:[email protected]/\".insteadOf \"ssh://[email protected]/\"" | ||||||||||||||||||||||
| docker exec "$CONTAINER_NAME" "git config --global url.\"https://git:[email protected]/\".insteadOf \"[email protected]:\"" | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
|
Comment on lines
+39
to
+46
There was a problem hiding this comment. Security and performance improvements needed Several concerns with the current implementation:
Consider these improvements: - docker exec "$CONTAINER_NAME" "git config --global credential.helper store"
- docker exec "$CONTAINER_NAME" "git config --global --replace-all url.\"https://token:[email protected]/\".insteadOf ssh://[email protected]/"
- docker exec "$CONTAINER_NAME" "git config --global --add url.\"https://token:[email protected]/\".insteadOf [email protected]"
- docker exec "$CONTAINER_NAME" "git config --global --add url.\"https://token:[email protected]/\".insteadOf \"https://github.com/\""
-
- docker exec "$CONTAINER_NAME" "git config --global url.\"https://ssh:[email protected]/\".insteadOf \"ssh://[email protected]/\""
- docker exec "$CONTAINER_NAME" "git config --global url.\"https://git:[email protected]/\".insteadOf \"[email protected]:\""
+ # Validate token format
+ if [[ ! $git_private_token =~ ^gh[ps]_[a-zA-Z0-9]{36}$ ]]; then
+ echo "Error: Invalid GitHub token format"
+ exit 1
+ fi
+
+ # Combine all git configs into a single command
+ docker exec "$CONTAINER_NAME" /bin/bash -c '
+ git config --global credential.helper store
+ git config --global credential.helper "store --file=/dev/null" # Don't persist credentials
+ for protocol in "ssh://[email protected]/" "[email protected]" "https://github.com/"; do
+ git config --global --add url."https://oauth:[email protected]/".insteadOf "$protocol"
+ done'
|
||||||||||||||||||||||
| fi | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| echo "---------- git config --list -------------" | ||||||||||||||||||||||
| docker exec "$CONTAINER_NAME" "git --no-pager config --list" | ||||||||||||||||||||||
|
|
||||||||||||||||||||||
| echo "---------- git config --list --show-origin -------------" | ||||||||||||||||||||||
| docker exec "$CONTAINER_NAME" "git --no-pager config --list --show-origin" | ||||||||||||||||||||||
|
Comment on lines
+49
to
+53
There was a problem hiding this comment. Secure debug output The current debug output might expose sensitive information including the Git token. -echo "---------- git config --list -------------"
-docker exec "$CONTAINER_NAME" "git --no-pager config --list"
-
-echo "---------- git config --list --show-origin -------------"
-docker exec "$CONTAINER_NAME" "git --no-pager config --list --show-origin"
+echo "---------- git config (sanitized) -------------"
+docker exec "$CONTAINER_NAME" "git --no-pager config --list | sed -E 's/(oauth|token):[^@]+@/\1:***@/g'"
+
+echo "---------- git config origins -------------"
+docker exec "$CONTAINER_NAME" "git --no-pager config --list --show-origin | grep -v 'url\.'"📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Codebase verification
Security concerns identified in Git credential handling
Several security issues need to be addressed in the credential handling scripts:
git config --list--globalfor git config affects the entire user environment instead of being scoped to the repositoryKey locations requiring changes:
src/scripts/linux/set-gitcredential.sh: Removegit config --listcommands, use--localinstead of--globalsrc/scripts/windows/set-gitcredential.sh: Remove config listing, use local scopesrc/scripts/macos/set-gitcredential.sh: Same issues as Linux scriptRecommended improvements:
--globalwith--localin all git config commandsgit config --listdebug commands🔗 Analysis chain
Verify secure credential handling in external scripts
The step correctly handles different operating systems, but we should verify the security of credential handling in the referenced scripts.
Let's check the referenced scripts for secure practices:
Additionally, consider these security improvements:
--localinstead of--globalfor git config to avoid affecting other repositoriesLet me gather more information about the scripts since the previous attempt didn't show their contents.
Let's examine the content of these scripts to understand the complete credential handling flow.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
Length of output: 833
Script:
Length of output: 1176
Script:
Length of output: 5005