Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Mask Git credentials in the error message #10115

Merged
merged 1 commit into from Oct 2, 2021
Merged

Mask Git credentials in the error message #10115

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
28 changes: 28 additions & 0 deletions src/Composer/Util/Git.php
View file
Open in desktop
Expand Up @@ -98,6 +98,7 @@ public function runCommand($commandCallable, $url, $cwd, $initialClone = false)
$command = call_user_func($commandCallable, $url);

$auth = null;
$credentials = array();
if ($bypassSshForGitHub || 0 !== $this->process->execute($command, $ignoredOutput, $cwd)) {
$errorMsg = $this->process->getErrorOutput();
// private github repository without ssh key access, try https with auth
Expand All @@ -121,6 +122,7 @@ public function runCommand($commandCallable, $url, $cwd, $initialClone = false)
return;
}

$credentials = array(rawurlencode($auth['username']), rawurlencode($auth['password']));
$errorMsg = $this->process->getErrorOutput();
}
} elseif (preg_match('{^https://(bitbucket\.org)/(.*?)(?:\.git)?$}i', $url, $match)) { //bitbucket oauth
Expand Down Expand Up @@ -155,6 +157,7 @@ public function runCommand($commandCallable, $url, $cwd, $initialClone = false)
return;
}

$credentials = array(rawurlencode($auth['username']), rawurlencode($auth['password']));
$errorMsg = $this->process->getErrorOutput();
} else { // Falling back to ssh
$sshUrl = 'git@bitbucket.org:' . $match[2] . '.git';
Expand Down Expand Up @@ -196,6 +199,7 @@ public function runCommand($commandCallable, $url, $cwd, $initialClone = false)
return;
}

$credentials = array(rawurlencode($auth['username']), rawurlencode($auth['password']));
$errorMsg = $this->process->getErrorOutput();
}
} elseif ($this->isAuthenticationFailure($url, $match)) { // private non-github/gitlab/bitbucket repo that failed to authenticate
Expand Down Expand Up @@ -236,6 +240,7 @@ public function runCommand($commandCallable, $url, $cwd, $initialClone = false)
return;
}

$credentials = array(rawurlencode($auth['username']), rawurlencode($auth['password']));
$errorMsg = $this->process->getErrorOutput();
}
}
Expand All @@ -244,6 +249,10 @@ public function runCommand($commandCallable, $url, $cwd, $initialClone = false)
$this->filesystem->removeDirectory($origCwd);
}

if (count($credentials) > 0) {
$command = $this->maskCredentials($command, $credentials);
$errorMsg = $this->maskCredentials($errorMsg, $credentials);
}
$this->throwException('Failed to execute ' . $command . "\n\n" . $errorMsg, $url);
}
}
Expand Down Expand Up @@ -412,4 +421,23 @@ public static function getVersion(ProcessExecutor $process)

return self::$version;
}

private function maskCredentials(string $error, array $credentials)
Copy link
Contributor

@herndlm herndlm Oct 19, 2021 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stumbled over that while adding types for phpstan. $error was added with a PHP 7.0 scalar type declaration here. That is going to make problems, right? @Seldaek
UPDATE: created #10186

{
$maskedCredentials = array();

foreach ($credentials as $credential) {
if (in_array($credential, array('private-token', 'x-token-auth', 'oauth2', 'gitlab-ci-token', 'x-oauth-basic'))) {
$maskedCredentials[] = $credential;
} elseif (strlen($credential) > 6) {
$maskedCredentials[] = substr($credential, 0, 3) . '...' . substr($credential, -3);
} elseif (strlen($credential) > 3) {
$maskedCredentials[] = substr($credential, 0, 3) . '...';
} else {
$maskedCredentials[] = 'XXX';
}
}

return str_replace($credentials, $maskedCredentials, $error);
}
}