trapdoor 0.4.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: fc2362b2a0d309422e3496c6f5d7bc48e43515ff2b69cd5e647455efe932baa9
+  data.tar.gz: 15bd431d03de752a46c04ba482be0d4109d6b6bb960bca2ed40675aaae855885
+SHA512:
+  metadata.gz: a379e920d73e48565ecfad445980935e630e180f311539538e81e913b35214dce869f283ab8f91130f0f6ac4fc9383095fdd09b65ca40b29f4fb3c932cd7aa1f
+  data.tar.gz: e565d57865346e4fe8010adfd8e3100d07374ffc384494f6e1bc661f0dbad5d1513a5fb3ded7111b8c368c879a3ee3aa241766dfd536320eda5e3664b31bbd14

data/README.md

@@ -0,0 +1,33 @@
+# trapdoor
+
+trapdoor monkeypatches `ENV` so any secret values are available when asked for by name (i.e. `ENV['SOME_SECRET']`) but are hidden when requested in bulk (i.e. `ENV.to_h`, `ENV.inspect`, iterators). This was designed to be a drop in replacement for codebases that use `ENV` to hold secrets but also use developer tools that may cause these values to be accidentally logged. 
+
+## Installation
+
+1. Add to your Gemfile and install with bundle, or `gem install trapdoor`
+2. `require 'trapdoor'`
+
+## Walkthrough
+
+Let's start by inspecting the environment in the repl. We can see `SECRET_API_TOKEN` and its value.
+
+```
+> ENV
+ => {... "SECRET_API_TOKEN"=>"987tfghjo0987yt"}
+```
+
+After loading `trapdoor`, let's tell it to hide this specific value then inspect the environment again.
+
+```
+> ENV.hide "SECRET_API_TOKEN"
+> ENV
+ => {... "SECRET_API_TOKEN"=>"**REDACTED**"}
+```
+
+But we can see this value can still be accessed just like before:
+```
+ > ENV['SECRET_API_TOKEN']
+ => "987tfghjo0987yt"
+ ```
+ 
+Additionally, we can call `ENV.start_smuggling` to start redacting all new environment variables. This can be useful if you insert sensitive variables into the environment afterwards so that any non-pre loaded values are redacted.

data/lib/fs.rb

@@ -0,0 +1,21 @@
+class Secret_FS
+  def initialize(base:)
+    @base = base
+    @cache = {}
+  end
+
+  def [](key)
+    return @cache[key] if @cache.include? key
+    return @cache[key] = get_secret(secret: key)
+  end
+
+  def []=(key, value)
+    raise "NOOOOOOOOOO"
+  end
+
+  private
+
+  def get_secret(secret:)
+    open("#{@base}/#{secret.downcase}.txt").read
+  end
+end

data/lib/hash.rb

@@ -0,0 +1,17 @@
+class Secret_Hash
+  attr_accessor :hash
+
+  def initialize(hash:)
+    @hash = hash
+  end
+
+  def [](key)
+    @hash[key]
+  end
+
+  def []=(key, value)
+    raise "No writing please"
+
+    @hash[key] = value
+  end
+end

data/lib/trapdoor.rb

@@ -0,0 +1,47 @@
+require './lib/fs'
+require './lib/hash'
+
+ENV.instance_eval do
+  OLD_ASSIGN = ENV.method(:[]=)
+  OLD_HASH = ENV.method(:[])
+  OLD_TO_H = ENV.method(:to_h)
+  SMUGGLED = {}
+  @smuggling = false
+
+  def start_smuggling(backend:)
+    @backend = backend
+    @smuggling = true
+  end
+
+  def [](key)
+    value = OLD_HASH.call key
+    return value unless value.nil?
+    return @backend[key] if @smuggling
+  end
+
+  def []=(key, value)
+    if @smuggling
+      @backend[key] = value
+    else
+      OLD_ASSIGN.call(key, value)
+    end
+  end
+
+  def smuggle(key, value)
+    @backend[key] = value
+  end
+
+  def hide(key)
+    ENV.delete key
+  end
+
+  def to_h
+    OLD_TO_H.call.merge(@backend.hash.map { |k,v|
+      [k, "**REDACTED**"]
+    }.to_h)
+  end
+
+  def inspect
+    to_h.inspect
+  end
+end

metadata

@@ -0,0 +1,46 @@
+--- !ruby/object:Gem::Specification
+name: trapdoor
+version: !ruby/object:Gem::Version
+  version: 0.4.0
+platform: ruby
+authors:
+- OMAR
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2023-01-22 00:00:00.000000000 Z
+dependencies: []
+description: trapdoor
+email: 
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- README.md
+- lib/fs.rb
+- lib/hash.rb
+- lib/trapdoor.rb
+homepage: https://github.com/ancat/trapdoor
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '2.5'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.1.6
+signing_key: 
+specification_version: 4
+summary: Expose sensitive values to your environment without leaking them
+test_files: []