@sonisoft/now-sdk-ext-cli 5.0.0 → 5.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +72 -72
- package/bin/argv-guard.js +25 -0
- package/bin/argv-secrets.js +103 -0
- package/bin/dev.js +6 -2
- package/bin/run.js +6 -2
- package/dist/commands/auth/doctor.d.ts.map +1 -1
- package/dist/commands/auth/doctor.js +15 -3
- package/dist/commands/auth/doctor.js.map +1 -1
- package/oclif.manifest.json +1066 -1066
- package/package.json +1 -1
|
@@ -0,0 +1,103 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Refuse to run when a secret was passed as a command-line argument.
|
|
3
|
+
*
|
|
4
|
+
* Anything in argv is already exposed by the time this runs: the shell has
|
|
5
|
+
* written it to history, and it is visible to every process on the host via
|
|
6
|
+
* `ps auxww` for as long as this one lives. Neither can be undone from here.
|
|
7
|
+
*
|
|
8
|
+
* So this is not really prevention — it is detection plus an honest message. The
|
|
9
|
+
* user needs to know the value leaked and should be rotated, which is strictly
|
|
10
|
+
* more useful than oclif's "Nonexistent flag: --password". Refusing to run also
|
|
11
|
+
* makes the habit fail fast rather than working quietly until someone greps a
|
|
12
|
+
* shell history.
|
|
13
|
+
*
|
|
14
|
+
* None of these flags exist on any `nex` command today, so nothing legitimate is
|
|
15
|
+
* blocked. The check is deliberately conservative about that: it matches on flag
|
|
16
|
+
* NAME only, never on the shape of a value, because `nex exec` takes arbitrary
|
|
17
|
+
* scripts and `--query`, `--filter`, `--data`, `--payload` and `--spec` all take
|
|
18
|
+
* arbitrary text that can look like anything.
|
|
19
|
+
*
|
|
20
|
+
* Kept as plain JS in bin/ for the same reason as credstore-boot.js: it runs
|
|
21
|
+
* before oclif and before any build output is required.
|
|
22
|
+
*/
|
|
23
|
+
|
|
24
|
+
/**
|
|
25
|
+
* Long flags whose value would be a credential.
|
|
26
|
+
*
|
|
27
|
+
* Short flags are deliberately excluded — `-p` and `-t` are too easily something
|
|
28
|
+
* else, and a false positive here blocks legitimate work.
|
|
29
|
+
*/
|
|
30
|
+
const SECRET_FLAGS = new Set([
|
|
31
|
+
'--password',
|
|
32
|
+
'--passwd',
|
|
33
|
+
'--pass',
|
|
34
|
+
'--secret',
|
|
35
|
+
'--client-secret',
|
|
36
|
+
'--clientsecret',
|
|
37
|
+
'--token',
|
|
38
|
+
'--access-token',
|
|
39
|
+
'--refresh-token',
|
|
40
|
+
'--id-token',
|
|
41
|
+
'--auth-token',
|
|
42
|
+
'--user-token',
|
|
43
|
+
'--session-token',
|
|
44
|
+
'--api-key',
|
|
45
|
+
'--apikey',
|
|
46
|
+
'--credential',
|
|
47
|
+
'--credentials',
|
|
48
|
+
])
|
|
49
|
+
|
|
50
|
+
/**
|
|
51
|
+
* Returns details of the first secret-bearing argument, or null.
|
|
52
|
+
*
|
|
53
|
+
* Only reports when a value is actually present. `--password` with nothing after
|
|
54
|
+
* it, or followed by another flag, carries no secret — oclif will reject it as a
|
|
55
|
+
* missing value, which is not this file's problem.
|
|
56
|
+
*
|
|
57
|
+
* @param {string[]} argv
|
|
58
|
+
* @returns {{flag: string, form: 'inline' | 'separate'} | null}
|
|
59
|
+
*/
|
|
60
|
+
export function findSecretArgument(argv) {
|
|
61
|
+
if (!Array.isArray(argv)) return null
|
|
62
|
+
|
|
63
|
+
for (const [index, arg] of argv.entries()) {
|
|
64
|
+
if (typeof arg !== 'string' || !arg.startsWith('--')) continue
|
|
65
|
+
|
|
66
|
+
const equals = arg.indexOf('=')
|
|
67
|
+
const name = (equals === -1 ? arg : arg.slice(0, equals)).toLowerCase()
|
|
68
|
+
if (!SECRET_FLAGS.has(name)) continue
|
|
69
|
+
|
|
70
|
+
if (equals !== -1) {
|
|
71
|
+
// `--password=` with nothing after it carries no value.
|
|
72
|
+
if (arg.length > equals + 1) return {flag: name, form: 'inline'}
|
|
73
|
+
continue
|
|
74
|
+
}
|
|
75
|
+
|
|
76
|
+
const next = argv[index + 1]
|
|
77
|
+
if (next !== undefined && !next.startsWith('-')) return {flag: name, form: 'separate'}
|
|
78
|
+
}
|
|
79
|
+
|
|
80
|
+
return null
|
|
81
|
+
}
|
|
82
|
+
|
|
83
|
+
/**
|
|
84
|
+
* Human-facing message for a detected secret argument.
|
|
85
|
+
*
|
|
86
|
+
* Leads with the exposure rather than the refusal, because the exposure is the
|
|
87
|
+
* part the user has to act on and cannot undo.
|
|
88
|
+
*
|
|
89
|
+
* @param {{flag: string}} found
|
|
90
|
+
* @returns {string}
|
|
91
|
+
*/
|
|
92
|
+
export function secretArgumentMessage(found) {
|
|
93
|
+
return (
|
|
94
|
+
`nex: refusing to run — a secret was passed on the command line (${found.flag}).\n` +
|
|
95
|
+
`\nThat value is already in your shell history and was visible in the process\n` +
|
|
96
|
+
`list while this command started. Treat it as compromised and rotate it.\n` +
|
|
97
|
+
`\nRemediation: store credentials once instead of passing them per command.\n` +
|
|
98
|
+
` now-sdk auth --add <instance> # add a credential\n` +
|
|
99
|
+
` nex auth list # see what is stored\n` +
|
|
100
|
+
` nex --auth <alias> ... # select one per command\n` +
|
|
101
|
+
`\nFor non-interactive use, set the value in the environment rather than argv.\n`
|
|
102
|
+
)
|
|
103
|
+
}
|
package/bin/dev.js
CHANGED
|
@@ -1,8 +1,12 @@
|
|
|
1
1
|
#!/usr/bin/env -S node --loader ts-node/esm --disable-warning=ExperimentalWarning
|
|
2
2
|
|
|
3
|
-
// FIRST, deliberately:
|
|
4
|
-
//
|
|
3
|
+
// FIRST, deliberately: refuse to run if a secret was passed in argv, before
|
|
4
|
+
// anything can read, store, or log it. See bin/argv-guard.js.
|
|
5
5
|
// eslint-disable-next-line n/shebang
|
|
6
|
+
import './argv-guard.js'
|
|
7
|
+
|
|
8
|
+
// THEN: redirect SDK credential storage off the OS keyring before anything can
|
|
9
|
+
// read credentials. See bin/credstore-boot.js.
|
|
6
10
|
import './credstore-boot.js'
|
|
7
11
|
|
|
8
12
|
import {execute} from '@oclif/core'
|
package/bin/run.js
CHANGED
|
@@ -1,7 +1,11 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
|
|
3
|
-
// FIRST, deliberately:
|
|
4
|
-
//
|
|
3
|
+
// FIRST, deliberately: refuse to run if a secret was passed in argv, before
|
|
4
|
+
// anything can read, store, or log it. See bin/argv-guard.js.
|
|
5
|
+
import './argv-guard.js'
|
|
6
|
+
|
|
7
|
+
// THEN: redirect SDK credential storage off the OS keyring before anything can
|
|
8
|
+
// read credentials. See bin/credstore-boot.js.
|
|
5
9
|
import './credstore-boot.js'
|
|
6
10
|
|
|
7
11
|
import {execute} from '@oclif/core'
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,aAAa,CAAA;AAKnC;;;;;;;GAOG;AACH,qBAAa,UAAW,SAAQ,OAAO;IACrC,MAAM,CAAC,IAAI,KAAK;IAChB,MAAM,CAAC,WAAW,SAC2F;IAC7G,MAAM,CAAC,cAAc,UAAO;IAC5B,MAAM,CAAC,QAAQ;;;QAGd;IACH,MAAM,CAAC,KAAK;;MAAqB;IAGzB,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,aAAa,CAAA;AAKnC;;;;;;;GAOG;AACH,qBAAa,UAAW,SAAQ,OAAO;IACrC,MAAM,CAAC,IAAI,KAAK;IAChB,MAAM,CAAC,WAAW,SAC2F;IAC7G,MAAM,CAAC,cAAc,UAAO;IAC5B,MAAM,CAAC,QAAQ;;;QAGd;IACH,MAAM,CAAC,KAAK;;MAAqB;IAGzB,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;CAsE9B"}
|
|
@@ -44,11 +44,23 @@ export class AuthDoctor extends Command {
|
|
|
44
44
|
};
|
|
45
45
|
if (this.jsonEnabled())
|
|
46
46
|
return report;
|
|
47
|
-
this.log(`shim active : ${shimActive ? 'yes' : '
|
|
47
|
+
this.log(`shim active : ${shimActive ? 'yes' : 'no'}`);
|
|
48
48
|
if (!shimActive) {
|
|
49
|
+
// "no" is the DEFAULT, not a fault — the shim is opt-in. The previous
|
|
50
|
+
// wording ("NO", plus a hint to check SN_CRED_STORE_DISABLE) read as though
|
|
51
|
+
// something were broken, and pointed at the one variable that is almost
|
|
52
|
+
// never the reason. Say what to do instead.
|
|
49
53
|
this.log('');
|
|
50
|
-
this.log(' The SDK is reading the OS keyring
|
|
51
|
-
this.log('
|
|
54
|
+
this.log(' The SDK is reading the OS keyring. That is the default and works fine with an');
|
|
55
|
+
this.log(' interactive desktop session.');
|
|
56
|
+
this.log('');
|
|
57
|
+
this.log(' In a headless session — SSH, systemd, CI, an agent — the keyring cannot be');
|
|
58
|
+
this.log(' unlocked and will report no credentials whatever is stored. To use the store');
|
|
59
|
+
this.log(' listed below instead, pass --cred-store or set SN_CRED_STORE_ENABLE=1.');
|
|
60
|
+
if (process.env.SN_CRED_STORE_DISABLE) {
|
|
61
|
+
this.log('');
|
|
62
|
+
this.log(' NOTE: SN_CRED_STORE_DISABLE is set, which overrides both of those.');
|
|
63
|
+
}
|
|
52
64
|
}
|
|
53
65
|
this.log(`store : ${config.store}`);
|
|
54
66
|
this.log(`path : ${config.blobPath}`);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/commands/auth/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,aAAa,CAAA;AACnC,OAAO,EAAC,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAC,MAAM,wBAAwB,CAAA;AAEzF,OAAO,EAAC,aAAa,EAAC,MAAM,iCAAiC,CAAA;AAE7D;;;;;;;GAOG;AACH,MAAM,OAAO,UAAW,SAAQ,OAAO;IACrC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAA;IAChB,MAAM,CAAC,WAAW,GAChB,2GAA2G,CAAA;IAC7G,MAAM,CAAC,cAAc,GAAG,IAAI,CAAA;IAC5B,MAAM,CAAC,QAAQ,GAAG;QAChB,EAAC,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,iCAAiC,EAAC;QAChG,EAAC,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,gCAAgC,EAAC;KACvG,CAAA;IACH,MAAM,CAAC,KAAK,GAAG,EAAC,GAAG,aAAa,EAAC,CAAA;IAG/B,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAE5B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,GAAG,CAAA;QACvD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;QAEvC,wEAAwE;QACxE,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,OAAO,CAAA;QACX,IAAI,SAA6B,CAAA;QACjC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;YAC/B,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,UAAU;YACV,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAC,SAAS,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAA;QAED,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,MAAM,CAAA;QAErC,IAAI,CAAC,GAAG,CAAC,mBAAmB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACZ,IAAI,CAAC,GAAG,CAAC,
|
|
1
|
+
{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/commands/auth/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,aAAa,CAAA;AACnC,OAAO,EAAC,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAC,MAAM,wBAAwB,CAAA;AAEzF,OAAO,EAAC,aAAa,EAAC,MAAM,iCAAiC,CAAA;AAE7D;;;;;;;GAOG;AACH,MAAM,OAAO,UAAW,SAAQ,OAAO;IACrC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAA;IAChB,MAAM,CAAC,WAAW,GAChB,2GAA2G,CAAA;IAC7G,MAAM,CAAC,cAAc,GAAG,IAAI,CAAA;IAC5B,MAAM,CAAC,QAAQ,GAAG;QAChB,EAAC,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,iCAAiC,EAAC;QAChG,EAAC,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,gCAAgC,EAAC;KACvG,CAAA;IACH,MAAM,CAAC,KAAK,GAAG,EAAC,GAAG,aAAa,EAAC,CAAA;IAG/B,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QAE5B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,GAAG,CAAA;QACvD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;QAEvC,wEAAwE;QACxE,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,OAAO,CAAA;QACX,IAAI,SAA6B,CAAA;QACjC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;YAC/B,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,UAAU;YACV,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAC,SAAS,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAA;QAED,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,MAAM,CAAA;QAErC,IAAI,CAAC,GAAG,CAAC,mBAAmB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,sEAAsE;YACtE,4EAA4E;YAC5E,wEAAwE;YACxE,4CAA4C;YAC5C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACZ,IAAI,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAA;YAC3F,IAAI,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;YAC1C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACZ,IAAI,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAA;YACxF,IAAI,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAA;YAC1F,IAAI,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAA;YACpF,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBACZ,IAAI,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAA;YAClF,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC9C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACZ,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACrB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAA;YAC7D,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC5F,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;QACvD,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACZ,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAA;QAC3D,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,MAAM,SAAS,CAAC,CAAA;YAC3D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAChG,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC"}
|