Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NP_GITHUB_TOKEN should only be supplied as credentials for GitHub-hosted repositories #195

Open
bradlarsen opened this issue Jun 14, 2024 · 0 comments
Labels
bug Something isn't working integration Related to integration with other systems

Comments

@bradlarsen
Copy link
Collaborator

Describe the bug
A GitHub personal access token can be supplied to Nosey Parker via the NP_GITHUB_TOKEN environment variable. If a token is supplied, it is used for (a) GitHub REST API calls for repository enumeration (e.g., scan --github-org=octocat) and (b) credentials for the git clone operation if prompted by the remote server.

The problem is with (b): the personal access token is supplied to any remote, even non-GitHub-hosted ones, like https://example.com/some-git-repo.git.

To Reproduce

export NP_GITHUB_TOKEN=<your token>
noseyparker scan --git-url https://example.com/some-git-repo.git

If https://example.com/some-git-repo.git is configured to ask for credentials, noseyparker will supply <your token> to the server.

Expected behavior
NP_GITHUB_TOKEN should only be supplied as a credential to GitHub-hosted repositories.

Output of noseyparker --version

noseyparker 0.18.0-dev

Build Configuration:

    Build Timestamp:    2024-06-14T19:24:31.059745000Z

    Commit Timestamp:   2024-06-11T14:59:51.000000000-04:00
    Commit Branch:      main
    Commit SHA:         b42786641a9de1af0816f7a8d7683cc732410dee

    Cargo Features:     color_backtrace,default,mimalloc
    Debug:              true
    Optimization:       0
    Target Triple:      aarch64-apple-darwin

Build System:

    OS:                 Darwin
    OS Version:         MacOS 14.5

    CPU Vendor:         Apple
    CPU Brand:          Apple M3 Max
    CPU Cores:          14

    rustc Version:      1.77.2
    rustc Channel:      stable
    rustc Host Triple:  aarch64-apple-darwin
    rustc Commit Date:  2024-04-09
    rustc Commit SHA:   25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04
    rustc LLVM Version: 17.0
@bradlarsen bradlarsen added bug Something isn't working integration Related to integration with other systems labels Jun 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working integration Related to integration with other systems
Projects
None yet
Development

No branches or pull requests

1 participant