@capacitor/cli 6.2.1 → 6.2.3

package/dist/index.js

@@ -97,8 +97,8 @@ function runProgram(config) {
         .option('--keystorealias <keystoreAlias>', 'Key Alias in the keystore')
         .option('--configuration <name>', 'Configuration name of the iOS Scheme')
         .option('--keystorealiaspass <keystoreAliasPass>', 'Password for the Key Alias')
-        .addOption(new commander_1.Option('--androidreleasetype <androidreleasetype>', 'Android release type; APK or AAB').choices(['AAB', 'APK']))
-        .addOption(new commander_1.Option('--signing-type <signingtype>', 'Program used to sign apps (default: jarsigner)').choices(['apksigner', 'jarsigner']))
+        .addOption(new commander_1.Option('--androidreleasetype <androidreleasetype>', 'Android release type; APK or AAB').choices([...telemetry_1.TELEMETRY_SAFE_CHOICES.androidreleasetype]))
+        .addOption(new commander_1.Option('--signing-type <signingtype>', 'Program used to sign apps (default: jarsigner)').choices([...telemetry_1.TELEMETRY_SAFE_CHOICES.signingType]))
         .action((0, cli_1.wrapAction)((0, telemetry_1.telemetryAction)(config, async (platform, { scheme, flavor, keystorepath, keystorepass, keystorealias, keystorealiaspass, androidreleasetype, signingType, configuration, }) => {
         const { buildCommand } = await Promise.resolve().then(() => tslib_1.__importStar(require('./tasks/build')));
         await buildCommand(config, platform, {

package/dist/telemetry.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sendMetric = exports.telemetryAction = exports.THANK_YOU = void 0;
+exports.sendMetric = exports.getTelemetryVersion = exports.getTelemetryArguments = exports.getTelemetryError = exports.getTelemetryOptions = exports.telemetryAction = exports.TELEMETRY_SAFE_CHOICES = exports.THANK_YOU = void 0;
 const tslib_1 = require("tslib");
 const commander_1 = require("commander");
 const debug_1 = tslib_1.__importDefault(require("debug"));
@@ -13,6 +13,51 @@ const term_1 = require("./util/term");
 const debug = (0, debug_1.default)('capacitor:telemetry');
 exports.THANK_YOU = `\nThank you for helping to make Capacitor better! 💖` +
     `\nInformation about the data we collect is available on our website: ${colors_1.default.strong('https://capacitorjs.com/telemetry')}\n`;
+/**
+ * The option values that are safe to report, keyed by the option's resolved
+ * name (commander's `attributeName()`, so `--signing-type` is `signingType`).
+ * This is an allowlist by design: a denylist of password-like names would leak
+ * the first sensitive option someone adds.
+ *
+ * The option declarations in `index.ts` spread these same lists into
+ * `.choices()`, so an option cannot offer a choice this does not list.
+ */
+exports.TELEMETRY_SAFE_CHOICES = {
+    androidreleasetype: ['AAB', 'APK'],
+    signingType: ['apksigner', 'jarsigner'],
+};
+const telemetrySafeChoices = new Map(Object.entries(exports.TELEMETRY_SAFE_CHOICES).map(([name, choices]) => [
+    name,
+    new Set(choices),
+]));
+/**
+ * Positional argument values that are safe to report. Everything else is
+ * dropped, since arguments like `cap init`'s app name are user content.
+ */
+const TELEMETRY_ARGUMENT_ALLOWLIST = new Set(['android', 'ios', 'web']);
+/**
+ * Upper bound on the reported error, so a failed Gradle build cannot ship its
+ * entire log as a metric.
+ */
+const TELEMETRY_ERROR_MAX_LENGTH = 500;
+/**
+ * Shortest value worth scrubbing out of a reported error. An empty string would
+ * match between every character, and a one- or two-character option value--a
+ * port, a target index--appears throughout unrelated output, so redacting
+ * either destroys the error instead of sanitizing it.
+ */
+const TELEMETRY_REDACTION_MIN_LENGTH = 3;
+/**
+ * The characters a dependency spec may contain to be reported as-is. A version
+ * range has none of the `:/@` a URL or path spec needs, so specs such as
+ * `git+https://x-access-token:<token>@github.com/acme/plugin.git` and
+ * `file:/Users/<name>/dev/plugin` are reported as {@link NON_REGISTRY_VERSION}
+ * instead of shipping a credential or a local path. The pnpm and yarn workspace
+ * protocols are allowed through as the only exception, since they resolve
+ * within the repo and so cannot carry either.
+ */
+const TELEMETRY_SAFE_VERSION_PATTERN = /^(?:(?:workspace|catalog):)?[\w.\-+^~><=|* ]*$/;
+const NON_REGISTRY_VERSION = 'non-registry';
 function telemetryAction(config, action) {
     return async (...actionArgs) => {
         const start = new Date();
@@ -39,15 +84,16 @@ function telemetryAction(config, action) {
         const capacitorPackages = packages.filter(([k]) => k.startsWith('@capacitor/'));
         const versions = capacitorPackages.map(([k, v]) => [
             `${k.replace(/^@capacitor\//, '').replace(/-/g, '_')}_version`,
-            v,
+            getTelemetryVersion(v),
         ]);
+        const options = getTelemetryOptions(cmd);
         const data = {
             app_id: await getAppIdentifier(config),
             command,
-            arguments: cmd.args.join(' '),
-            options: JSON.stringify(cmd.opts()),
+            arguments: getTelemetryArguments(cmd),
+            options: JSON.stringify(options),
             duration,
-            error: error ? (error.message ? error.message : String(error)) : null,
+            error: getTelemetryError(cmd, error, config, options),
             node_version: process.version,
             os: config.cli.os,
             ...Object.fromEntries(versions),
@@ -67,6 +113,91 @@ function telemetryAction(config, action) {
     };
 }
 exports.telemetryAction = telemetryAction;
+/**
+ * Build the reported option map: every option name the command resolved, but
+ * only the values that cannot carry a secret. Booleans are kept because they
+ * cannot encode one, allowlisted options are kept when the value is one this
+ * file lists, and every other value--keystore passwords, paths, signing
+ * identities--becomes `null`.
+ */
+function getTelemetryOptions(cmd) {
+    return Object.fromEntries(Object.entries(cmd.opts()).map(([name, value]) => [
+        name,
+        isTelemetrySafeValue(name, value) ? value : null,
+    ]));
+}
+exports.getTelemetryOptions = getTelemetryOptions;
+function isTelemetrySafeValue(name, value) {
+    var _a, _b;
+    if (typeof value === 'boolean') {
+        return true;
+    }
+    return (typeof value === 'string' &&
+        ((_b = (_a = telemetrySafeChoices.get(name)) === null || _a === void 0 ? void 0 : _a.has(value)) !== null && _b !== void 0 ? _b : false));
+}
+/**
+ * The signing credentials `capacitor.config` can supply. `cap build` falls back
+ * to the config for each of these when the flag is absent, and the resolved
+ * value still reaches the `jarsigner` command line--so it can come back in its
+ * output without ever having appeared in `cmd.opts()`.
+ */
+function getConfiguredCredentials(config) {
+    return [
+        config.android.buildOptions.keystorePath,
+        config.android.buildOptions.keystorePassword,
+        config.android.buildOptions.keystoreAlias,
+        config.android.buildOptions.keystoreAliasPassword,
+    ].filter((value) => typeof value === 'string');
+}
+/**
+ * Build the reported error, scrubbed of every option value and positional
+ * argument the rest of the payload drops, plus the signing credentials the
+ * config can supply in place of a flag, then truncated.
+ *
+ * Failed subprocesses rethrow the tool's combined output, which echoes back
+ * the very values that were redacted out of the option map--`jarsigner` prints
+ * the keystore it was pointed at.
+ */
+function getTelemetryError(cmd, error, config, options = getTelemetryOptions(cmd)) {
+    if (!error) {
+        return null;
+    }
+    const values = cmd.opts();
+    const redacted = [
+        ...Object.entries(options)
+            .filter(([, value]) => value === null)
+            .map(([name]) => values[name]),
+        ...cmd.args.filter(arg => !TELEMETRY_ARGUMENT_ALLOWLIST.has(arg)),
+        ...getConfiguredCredentials(config),
+    ]
+        .filter((value) => typeof value === 'string' &&
+        value.length >= TELEMETRY_REDACTION_MIN_LENGTH)
+        .sort((a, b) => b.length - a.length);
+    const message = redacted.reduce((message, value) => message.split(value).join('<redacted>'), error.message ? error.message : String(error));
+    return message.slice(0, TELEMETRY_ERROR_MAX_LENGTH);
+}
+exports.getTelemetryError = getTelemetryError;
+/**
+ * Build the reported positional arguments, keeping only allowlisted values.
+ */
+function getTelemetryArguments(cmd) {
+    return cmd.args
+        .filter(arg => TELEMETRY_ARGUMENT_ALLOWLIST.has(arg))
+        .join(' ');
+}
+exports.getTelemetryArguments = getTelemetryArguments;
+/**
+ * Build the reported version of a Capacitor dependency, keeping the spec only
+ * when it is a version range. Specs that point somewhere--a git URL, a local
+ * path--are reported as being just that, since they can carry a token or a
+ * username.
+ */
+function getTelemetryVersion(spec) {
+    return spec && TELEMETRY_SAFE_VERSION_PATTERN.test(spec)
+        ? spec
+        : NON_REGISTRY_VERSION;
+}
+exports.getTelemetryVersion = getTelemetryVersion;
 /**
  * If telemetry is enabled, send a metric via IPC to a forked process for uploading.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capacitor/cli",
-  "version": "6.2.1",
+  "version": "6.2.3",
   "description": "Capacitor: Cross-platform apps with JavaScript and the web",
   "homepage": "https://capacitorjs.com",
   "author": "Ionic Team <hi@ionic.io> (https://ionic.io)",