fix(security) : Restrict credential file path to home directory#1147
fix(security) : Restrict credential file path to home directory#1147l3tchupkt wants to merge 4 commits intogoogle:masterfrom
Conversation
Prevent credential theft by validating that --auth path is strictly within the user's home directory. Blocks attacks that attempt to store credentials in world-readable locations like /tmp or /var/tmp for later exfiltration by an attacker. - Resolve path before validation - Check resolved path is within os.homedir() - Clear error message on validation failure
- Add symlink detection before credential write - Use O_NOFOLLOW | O_EXCL for atomic safe writes - Check realpath of home directory to bypass symlink tricks - Add race condition detection (EEXIST error handling)
l3tchupkt
changed the title
|
@sqrrrl please review!! |
|
Have to think about this one. May be too restrictive given the nature of the tool. There are legitimate use cases for secrets outside the home directory. Some CI/CD platforms allow mounting secrets as files. Currently have the --auth flag documented as deprecated, but it still may have some utility. Can you split this into two parts? I think most of the changes are OK (don't follow symlinks, maintaining correct file permissions, etc.) but the path part I'm less confident about. Alternatively, may be worth adding an option flag like --allow-unsafe-paths for this and other recent changes that may break some less common use cases. |
|
@sqrrrl Makes sense 👍 Goal was to prevent credential leaks since unsafe paths or symlinks can expose tokens (like in I’ll split it:
Let me know your thoughts. |
|
sounds good |
2 participants
fixes(#1148)
Prevent credential theft by validating --auth paths and blocking
symlink attacks that could exfiltrate OAuth tokens.
Changes:
Fixes: Credential path injection and symlink bypass vulnerabilities
npm run testsucceeds.npm run lintsucceeds.