-
Notifications
You must be signed in to change notification settings - Fork 188
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Nimble Publish Command Security Leak #910
Comments
Strange, Nimble never did that for me... How to reproduce? Just "nimble publish"? |
Yup. Just |
How did you get a Git repo with such a URL? Sounds like a pretty bad idea to include a token in the URL, we have SSH keys for a reason. |
I don't know how such URL came up. I set up Github like ages ago and I don't remember what I did back then. You can tell that from the format of the token that it was Github's old OAuth token. They don't use that format anymore. My guess is that I set it up to work with Github's OAuth, which I believe is still one of Github's recommended authentication methods. So far, I never have to deal with such URLs. It is transparently done behind the scene. I was learning about Nim through the "Nim in Action" book, which is an excellent book by the way. I used the I think it would be nice if Nimble should explicitly ask for the URL because people may connect to Github through a different means from the way the general public should download the module. |
Looking at GitHub's docs, there is a warning not to clone with these URLs which is what I guess you (or another app did): https://docs.github.com/en/github/extending-github/git-automation-with-oauth-tokens#step-2-clone-a-repository Nimble simply reads your git repo's remote URL, any other app can do the same since this is all stored in plaintext (some might have already done it without you being aware of it!) We should likely strip the username/password info away from any URL we find in Nimble before publishing, but I feel like the real problem here is that it's possible to store something like this in Git, maybe it's something for Git to warn about/disallow? |
@dom96 I love your book. It does wonder in getting people up to speed with Nim. The book got me into Nim. It is really well written. It has a nice balance between brevity and being thorough. If nimble decides to strip the URL, I should point out that in my case it was using the old format which is |
Ok. Now I know how the URL came about. When you switch from using SSH to HTTPS, by specifiying So naturally this problem affects people who use HTTPS. |
Never mind what I said earlier. I had the URL set in my gitconfig. I don't remember why I did that. |
I used
nimble publish
command to publish my first nimble package recently. Nimble automatically added my github security token into the nimble package list and pushed it to github. It was something like this.Github automatically detected the leak and revoked the token.
It is better for Nimble to ask for the url, than trying to figure things out on its own and expose someone's security credential. This needs fixing.
The text was updated successfully, but these errors were encountered: