@capacitor/cli 7.6.9 → 7.6.10

package/dist/index.js

@@ -105,24 +105,14 @@ function runProgram(config) {
         .option('--configuration <name>', 'Configuration name of the iOS Scheme')
         .option('--keystorealiaspass <keystoreAliasPass>', 'Password for the Key Alias')
         .addOption(new commander_1.Option('--androidreleasetype <androidreleasetype>', 'Android release type; APK or AAB').choices([
-        'AAB',
-        'APK',
+        ...telemetry_1.TELEMETRY_SAFE_CHOICES.androidreleasetype,
     ]))
         .addOption(new commander_1.Option('--signing-type <signingtype>', 'Program used to sign apps (default: jarsigner)').choices([
-        'apksigner',
-        'jarsigner',
+        ...telemetry_1.TELEMETRY_SAFE_CHOICES.signingType,
     ]))
         .addOption(new commander_1.Option('--xcode-team-id <xcodeTeamID>', 'The Developer team to use for building and exporting the archive'))
-        .addOption(new commander_1.Option('--xcode-export-method <xcodeExportMethod>', 'Describes how xcodebuild should export the archive (default:  app-store-connect)').choices([
-        'app-store-connect',
-        'release-testing',
-        'enterprise',
-        'debugging',
-        'developer-id',
-        'mac-application',
-        'validation',
-    ]))
-        .addOption(new commander_1.Option('--xcode-signing-style <xcodeSigningStyle>', 'The iOS signing style to use when building the app for distribution (default: automatic)').choices(['automatic', 'manual']))
+        .addOption(new commander_1.Option('--xcode-export-method <xcodeExportMethod>', 'Describes how xcodebuild should export the archive (default:  app-store-connect)').choices([...telemetry_1.TELEMETRY_SAFE_CHOICES.xcodeExportMethod]))
+        .addOption(new commander_1.Option('--xcode-signing-style <xcodeSigningStyle>', 'The iOS signing style to use when building the app for distribution (default: automatic)').choices([...telemetry_1.TELEMETRY_SAFE_CHOICES.xcodeSigningStyle]))
         .addOption(new commander_1.Option('--xcode-signing-certificate <xcodeSigningCertificate>', 'A certificate name, SHA-1 hash, or automatic selector to use for signing for iOS builds'))
         .addOption(new commander_1.Option('--xcode-provisioning-profile <xcodeProvisioningProfile>', 'A provisioning profile name or UUID for iOS builds'))
         .action((0, cli_1.wrapAction)((0, telemetry_1.telemetryAction)(config, async (platform, { scheme, flavor, keystorepath, keystorepass, keystorealias, keystorealiaspass, androidreleasetype, signingType, configuration, xcodeTeamId, xcodeExportMethod, xcodeSigningStyle, xcodeSigningCertificate, xcodeProvisioningProfile, }) => {

package/dist/telemetry.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sendMetric = exports.telemetryAction = void 0;
+exports.sendMetric = exports.getTelemetryVersion = exports.getTelemetryArguments = exports.getTelemetryError = exports.getTelemetryOptions = exports.telemetryAction = exports.TELEMETRY_SAFE_CHOICES = void 0;
 const tslib_1 = require("tslib");
 const commander_1 = require("commander");
 const debug_1 = tslib_1.__importDefault(require("debug"));
@@ -14,6 +14,58 @@ const debug = (0, debug_1.default)('capacitor:telemetry');
 const THANK_YOU = `\nThank you for helping improve Capacitor by sharing anonymous usage data! 💖` +
     `\nInformation about the data we collect is available on our website: ${colors_1.default.strong('https://capacitorjs.com/docs/next/cli/telemetry')}` +
     `\nYou can disable telemetry at any time by using the ${colors_1.default.input('npx cap telemetry off')} command.`;
+/**
+ * The option values that are safe to report, keyed by the option's resolved
+ * name (commander's `attributeName()`, so `--signing-type` is `signingType`).
+ * This is an allowlist by design: a denylist of password-like names would leak
+ * the first sensitive option someone adds.
+ *
+ * The option declarations in `index.ts` spread these same lists into
+ * `.choices()`, so an option cannot offer a choice this does not list.
+ */
+exports.TELEMETRY_SAFE_CHOICES = {
+    androidreleasetype: ['AAB', 'APK'],
+    signingType: ['apksigner', 'jarsigner'],
+    xcodeExportMethod: [
+        'app-store-connect',
+        'release-testing',
+        'enterprise',
+        'debugging',
+        'developer-id',
+        'mac-application',
+        'validation',
+    ],
+    xcodeSigningStyle: ['automatic', 'manual'],
+};
+const telemetrySafeChoices = new Map(Object.entries(exports.TELEMETRY_SAFE_CHOICES).map(([name, choices]) => [name, new Set(choices)]));
+/**
+ * Positional argument values that are safe to report. Everything else is
+ * dropped, since arguments like `cap init`'s app name are user content.
+ */
+const TELEMETRY_ARGUMENT_ALLOWLIST = new Set(['android', 'ios', 'web']);
+/**
+ * Upper bound on the reported error, so a failed Gradle or Xcode build cannot
+ * ship its entire log as a metric.
+ */
+const TELEMETRY_ERROR_MAX_LENGTH = 500;
+/**
+ * Shortest value worth scrubbing out of a reported error. An empty string would
+ * match between every character, and a one- or two-character option value--a
+ * port, a target index--appears throughout unrelated output, so redacting
+ * either destroys the error instead of sanitizing it.
+ */
+const TELEMETRY_REDACTION_MIN_LENGTH = 3;
+/**
+ * The characters a dependency spec may contain to be reported as-is. A version
+ * range has none of the `:/@` a URL or path spec needs, so specs such as
+ * `git+https://x-access-token:<token>@github.com/acme/plugin.git` and
+ * `file:/Users/<name>/dev/plugin` are reported as {@link NON_REGISTRY_VERSION}
+ * instead of shipping a credential or a local path. The pnpm and yarn workspace
+ * protocols are allowed through as the only exception, since they resolve
+ * within the repo and so cannot carry either.
+ */
+const TELEMETRY_SAFE_VERSION_PATTERN = /^(?:(?:workspace|catalog):)?[\w.\-+^~><=|* ]*$/;
+const NON_REGISTRY_VERSION = 'non-registry';
 function telemetryAction(config, action) {
     return async (...actionArgs) => {
         const start = new Date();
@@ -40,15 +92,16 @@ function telemetryAction(config, action) {
         const capacitorPackages = packages.filter(([k]) => k.startsWith('@capacitor/'));
         const versions = capacitorPackages.map(([k, v]) => [
             `${k.replace(/^@capacitor\//, '').replace(/-/g, '_')}_version`,
-            v,
+            getTelemetryVersion(v),
         ]);
+        const options = getTelemetryOptions(cmd);
         const data = {
             app_id: await getAppIdentifier(config),
             command,
-            arguments: cmd.args.join(' '),
-            options: JSON.stringify(cmd.opts()),
+            arguments: getTelemetryArguments(cmd),
+            options: JSON.stringify(options),
             duration,
-            error: error ? (error.message ? error.message : String(error)) : null,
+            error: getTelemetryError(cmd, error, config, options),
             node_version: process.version,
             os: config.cli.os,
             ...Object.fromEntries(versions),
@@ -69,6 +122,86 @@ function telemetryAction(config, action) {
     };
 }
 exports.telemetryAction = telemetryAction;
+/**
+ * Build the reported option map: every option name the command resolved, but
+ * only the values that cannot carry a secret. Booleans are kept because they
+ * cannot encode one, allowlisted options are kept when the value is one this
+ * file lists, and every other value--keystore passwords, paths, signing
+ * identities--becomes `null`.
+ */
+function getTelemetryOptions(cmd) {
+    return Object.fromEntries(Object.entries(cmd.opts()).map(([name, value]) => [name, isTelemetrySafeValue(name, value) ? value : null]));
+}
+exports.getTelemetryOptions = getTelemetryOptions;
+function isTelemetrySafeValue(name, value) {
+    var _a, _b;
+    if (typeof value === 'boolean') {
+        return true;
+    }
+    return typeof value === 'string' && ((_b = (_a = telemetrySafeChoices.get(name)) === null || _a === void 0 ? void 0 : _a.has(value)) !== null && _b !== void 0 ? _b : false);
+}
+/**
+ * The signing credentials `capacitor.config` can supply. `cap build` falls back
+ * to the config for each of these when the flag is absent, and the resolved
+ * value still reaches the `xcodebuild` and `jarsigner` command lines--so it can
+ * come back in their output without ever having appeared in `cmd.opts()`.
+ */
+function getConfiguredCredentials(config) {
+    return [
+        config.android.buildOptions.keystorePath,
+        config.android.buildOptions.keystorePassword,
+        config.android.buildOptions.keystoreAlias,
+        config.android.buildOptions.keystoreAliasPassword,
+        config.ios.buildOptions.teamId,
+        config.ios.buildOptions.signingCertificate,
+        config.ios.buildOptions.provisioningProfile,
+    ].filter((value) => typeof value === 'string');
+}
+/**
+ * Build the reported error, scrubbed of every option value and positional
+ * argument the rest of the payload drops, plus the signing credentials the
+ * config can supply in place of a flag, then truncated.
+ *
+ * Failed subprocesses rethrow the tool's combined output, which echoes back
+ * the very values that were redacted out of the option map--`xcodebuild`
+ * prints its command-line build settings, `jarsigner` prints the keystore it
+ * was pointed at.
+ */
+function getTelemetryError(cmd, error, config, options = getTelemetryOptions(cmd)) {
+    if (!error) {
+        return null;
+    }
+    const values = cmd.opts();
+    const redacted = [
+        ...Object.entries(options)
+            .filter(([, value]) => value === null)
+            .map(([name]) => values[name]),
+        ...cmd.args.filter((arg) => !TELEMETRY_ARGUMENT_ALLOWLIST.has(arg)),
+        ...getConfiguredCredentials(config),
+    ]
+        .filter((value) => typeof value === 'string' && value.length >= TELEMETRY_REDACTION_MIN_LENGTH)
+        .sort((a, b) => b.length - a.length);
+    const message = redacted.reduce((message, value) => message.replaceAll(value, '<redacted>'), error.message ? error.message : String(error));
+    return message.slice(0, TELEMETRY_ERROR_MAX_LENGTH);
+}
+exports.getTelemetryError = getTelemetryError;
+/**
+ * Build the reported positional arguments, keeping only allowlisted values.
+ */
+function getTelemetryArguments(cmd) {
+    return cmd.args.filter((arg) => TELEMETRY_ARGUMENT_ALLOWLIST.has(arg)).join(' ');
+}
+exports.getTelemetryArguments = getTelemetryArguments;
+/**
+ * Build the reported version of a Capacitor dependency, keeping the spec only
+ * when it is a version range. Specs that point somewhere--a git URL, a local
+ * path--are reported as being just that, since they can carry a token or a
+ * username.
+ */
+function getTelemetryVersion(spec) {
+    return spec && TELEMETRY_SAFE_VERSION_PATTERN.test(spec) ? spec : NON_REGISTRY_VERSION;
+}
+exports.getTelemetryVersion = getTelemetryVersion;
 /**
  * If telemetry is enabled, send a metric via IPC to a forked process for uploading.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capacitor/cli",
-  "version": "7.6.9",
+  "version": "7.6.10",
   "description": "Capacitor: Cross-platform apps with JavaScript and the web",
   "homepage": "https://capacitorjs.com",
   "author": "Ionic Team <hi@ionic.io> (https://ionic.io)",