Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(config): use redact on config output #7521

Merged
merged 6 commits into from
May 14, 2024
Merged

Conversation

lukekarrys
Copy link
Contributor

Fixes #3867

@lukekarrys lukekarrys requested a review from a team as a code owner May 13, 2024 22:41
@npm-cli-bot
Copy link
Collaborator

npm-cli-bot commented May 13, 2024

no statistically significant performance changes detected

timing results
app-large clean lock-only cache-only modules-only no-lock no-cache no-modules no-clean show-version run-script cache-only
peer-deps
no-clean
audit
npm@latest 33.889 ±1.16 10.629 ±0.03 11.739 ±0.03 1.555 ±0.00 1.549 ±0.00 1.285 ±0.01 8.234 ±0.00 1.296 ±0.01 0.139 ±0.00 0.167 ±0.00 13.357 ±0.19 3.519 ±2.06
#7521 32.651 ±0.92 10.619 ±0.00 11.680 ±0.02 1.561 ±0.05 1.544 ±0.02 1.270 ±0.01 8.248 ±0.05 1.291 ±0.02 0.137 ±0.00 0.164 ±0.00 14.672 ±0.02 2.164 ±0.09
app-medium clean lock-only cache-only modules-only no-lock no-cache no-modules no-clean show-version run-script cache-only
peer-deps
no-clean
audit
npm@latest 26.959 ±1.76 7.944 ±0.02 8.856 ±0.03 1.519 ±0.01 1.515 ±0.00 1.413 ±0.01 5.796 ±0.01 1.318 ±0.01 0.139 ±0.00 0.165 ±0.00 9.528 ±0.17 3.052 ±1.55
#7521 25.791 ±1.42 7.956 ±0.03 8.819 ±0.02 1.509 ±0.01 1.497 ±0.01 1.408 ±0.00 5.839 ±0.03 1.313 ±0.01 0.139 ±0.00 0.166 ±0.00 9.822 ±0.05 1.986 ±0.08

lib/commands/config.js Outdated Show resolved Hide resolved
@wraithgar
Copy link
Member

I think if we're gonna redact we redact. We should acknowledge that there are some values that aren't worth showing at all (and they are currently accounted for) but some that may contain urls with passwords. Proxy and registry come to mind. If we simply pass all of the displayed values through redact (now that we are using it) this would help

@lukekarrys
Copy link
Contributor Author

+1 for treating registry however we end up treating proxy

@lukekarrys lukekarrys changed the title fix(config): protect proxy if it contains basic auth fix(config): protect url fields if they contain basic auth May 14, 2024
lib/commands/config.js Outdated Show resolved Hide resolved
@lukekarrys lukekarrys changed the title fix(config): protect url fields if they contain basic auth fix(config): use redact on config output May 14, 2024
lib/commands/config.js Outdated Show resolved Hide resolved
@lukekarrys lukekarrys merged commit badeac2 into latest May 14, 2024
23 checks passed
@lukekarrys lukekarrys deleted the lk/protect-proxy branch May 14, 2024 20:49
@github-actions github-actions bot mentioned this pull request May 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[BUG] Password in plain text when getting the proxy details from config through CLI
3 participants