vaultez-cli 0.2.2 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 14c54ce2993304e11bb04d4295bdc8fbab8596f7387db6fa4639c1e32dd40e7c
-  data.tar.gz: ec8e484b39065e1a3221c60bc3d5acf431c51f8daeb77c03658cbc439f5b73b7
+  metadata.gz: 78043da2b439dff80b3ed04f33ee62a77936276e5bd60935be94d2eca29592f0
+  data.tar.gz: aa76a4503506bd47d5e5b8a582725fbcee604bfdd0b23976e868e13bb7af2240
 SHA512:
-  metadata.gz: 13ba71b6797e10a7cb46d15b9b61e76b18817d1de62c541eadfc44a994172bf2c21df2f526e9b7b2b0f0bbb6464402caf4a0562ca51aa62d20ebcbc698913007
-  data.tar.gz: 9bc5011daa631088362b7bfb6b3153f87eec3471ef568d477b8dde69572690620b67257c819f3a3b9e98e57351637f0200e43c6e0dc3d62f2ad68ac20bc272f6
+  metadata.gz: 1214dc2431ac95bac73be69ce5ed35a6bb1f854ebbdede1e011954bf6161e3031ef1a628f810ff531284fb228808a86f4d8a33df8bfab776c6d756d87c3dec5f
+  data.tar.gz: 1c9dcf449a65eeba1412ecae189f4d00cbae4cfe98437c7ed649a559b0868ad4f17e09090d92b6483a4d62c35154918dc738ae0695f4db8465cb251b1b62c8c9

data/lib/vaultez/cli.rb

@@ -12,14 +12,6 @@ module Vaultez
 
     map %w[--version -v] => :__version
 
-    class_option :token, type: :string, banner: "TOKEN",
-                         desc: "Use a project token instead of the saved session"
-
-    def initialize(*args)
-      super
-      ENV["VAULTEZ_TOKEN"] = options[:token] if options[:token]
-    end
-
     desc "login", "Authenticate with email, password, and 2FA code"
     long_desc <<~DESC, wrap: false
       Authenticate with your Vaultez account. You will be prompted for your
@@ -55,14 +47,17 @@ module Vaultez
         vaultez fetch --company="Acme" --project="Backend"
         vaultez fetch --company="Acme" --project="Backend" --secret="DATABASE_URL"
 
-      PROJECT TOKEN (VAULTEZ_TOKEN env var or --token flag):
+      PROJECT TOKEN (VAULTEZ_TOKEN env var):
         When a project token is active, it already knows which project to use.
         No --project flag is needed.
 
         VAULTEZ_TOKEN=vz_... vaultez fetch
-        vaultez fetch --token=vz_... --secret="DATABASE_URL"
+        VAULTEZ_TOKEN=vz_... vaultez fetch --secret="DATABASE_URL"
 
       Project tokens can be created in the Tokens tab of your project settings.
+      Always pass the token via the VAULTEZ_TOKEN environment variable, never
+      as a command-line flag — CLI arguments are visible to other local users
+      via `ps` and get saved in shell history.
     DESC
     option :companies, type: :boolean, desc: "List all your companies"
     option :company,   type: :string,  desc: "Company name"
@@ -103,15 +98,14 @@ module Vaultez
         puts "  help        Show help for any command"
         puts
         puts "Options:"
-        puts "  --token     Use a project token instead of the saved session"
         puts "  --version   Show the installed CLI version"
         puts
         puts "Examples:"
         puts "  vaultez login"
         puts "  vaultez fetch --project=\"Backend\""
         puts "  vaultez fetch --project=\"Backend\" --secret=\"DATABASE_URL\""
-        puts "  vaultez fetch --token=\"vz_...\""
-        puts "  vaultez fetch --token=\"vz_...\" --secret=\"DATABASE_URL\""
+        puts "  VAULTEZ_TOKEN=\"vz_...\" vaultez fetch"
+        puts "  VAULTEZ_TOKEN=\"vz_...\" vaultez fetch --secret=\"DATABASE_URL\""
       end
     end
   end

data/lib/vaultez/client.rb

@@ -4,6 +4,14 @@ require "uri"
 
 module Vaultez
   class Client
+    # A legitimate response (companies/projects/secrets, all short strings)
+    # is a handful of KB at most. This bounds how much of a compromised or
+    # malicious response - a compromised API backend, a MITM'd/redirected
+    # api_url, or a compromised account crafting an oversized payload - this
+    # process will hold in memory, independent of any size limit a caller
+    # (e.g. the oma-vaultez plugin) enforces on this CLI's own stdout.
+    MAX_RESPONSE_BYTES = 4 * 1024 * 1024
+
     def initialize
       @api_url       = Vaultez::Config.api_url
       @token         = Vaultez::Config.token
@@ -68,7 +76,9 @@ module Vaultez
       req.body = body.to_json if body
 
       begin
-        response = http.request(req)
+        response = fetch_bounded(http, req)
+      rescue Vaultez::Error
+        raise
       rescue StandardError => error
         raise Vaultez::ApiError, "Could not reach the Vaultez API: #{error.message}"
       end
@@ -76,6 +86,27 @@ module Vaultez
       parse_response(response)
     end
 
+    # Reads the response body incrementally instead of Net::HTTP's default
+    # #request behavior, which fully buffers the entire body in memory
+    # before returning with no size limit at all. Aborts (closing the
+    # connection) the moment the body crosses MAX_RESPONSE_BYTES, rather
+    # than finishing the download and only noticing afterward.
+    def fetch_bounded(http, req)
+      response = nil
+      body = +""
+      http.request(req) do |res|
+        response = res
+        res.read_body do |chunk|
+          body << chunk
+          if body.bytesize > MAX_RESPONSE_BYTES
+            raise Vaultez::ApiError, "Vaultez API response exceeded the maximum allowed size"
+          end
+        end
+      end
+      response.body = body
+      response
+    end
+
     def build_request(method, uri)
       case method
       when :get    then Net::HTTP::Get.new(uri)

data/lib/vaultez/config.rb

@@ -41,12 +41,30 @@ module Vaultez
 
     def self.read
       return {} unless File.exist?(CONFIG_PATH)
+      tighten_permissions
       YAML.safe_load(File.read(CONFIG_PATH)) || {}
     end
 
     def self.write(data)
-      FileUtils.mkdir_p(File.dirname(CONFIG_PATH))
-      File.write(CONFIG_PATH, data.to_yaml)
+      dir = File.dirname(CONFIG_PATH)
+      FileUtils.mkdir_p(dir, mode: 0o700)
+      # The mode argument to mkdir_p/File.open only applies at creation time,
+      # so explicitly chmod too - this also retroactively tightens a config
+      # directory/file that was created before this fix, which would
+      # otherwise stay world-readable forever (0644/0755 by default umask).
+      File.chmod(0o700, dir)
+      File.open(CONFIG_PATH, File::CREAT | File::TRUNC | File::WRONLY, 0o600) do |f|
+        f.write(data.to_yaml)
+      end
+      File.chmod(0o600, CONFIG_PATH)
+    end
+
+    def self.tighten_permissions
+      dir = File.dirname(CONFIG_PATH)
+      File.chmod(0o700, dir) if File.directory?(dir) && (File.stat(dir).mode & 0o777) != 0o700
+      File.chmod(0o600, CONFIG_PATH) if (File.stat(CONFIG_PATH).mode & 0o777) != 0o600
+    rescue StandardError
+      nil # best-effort; never block a read over a permissions fix
     end
   end
 end

data/lib/vaultez/version.rb

@@ -1,3 +1,3 @@
 module Vaultez
-  VERSION = "0.2.2"
+  VERSION = "0.3.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vaultez-cli
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.3.1
 platform: ruby
 authors:
 - Nur Ketene
@@ -58,7 +58,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: CLI tool for Vaultez — manage your secrets from the terminal
 test_files: []