Skip to content

Commit eca70d0

Browse files
⚠️ [Security]: Mask sensitive data from git config --list (#259)
## Description This pull request involves significant updates to the `Get-GitHubGitConfig.ps1` script to enhance its functionality and improve code readability. The most important changes include adding a parameter for specifying the scope of the git configuration, improving error messages, and updating the way git configuration data is processed and returned. Enhancements to functionality: * [`src/functions/public/Git/Get-GitHubGitConfig.ps1`](diffhunk://#diff-dfb306c31ba449aae53bfc9d39801cb64924641ebf9f953e6eed74a02877ee40L16-R20): Added a new parameter `$Scope` with validation to allow specifying 'local', 'global', or 'system' scope for the git configuration. Improvements to code readability: * [`src/functions/public/Git/Get-GitHubGitConfig.ps1`](diffhunk://#diff-dfb306c31ba449aae53bfc9d39801cb64924641ebf9f953e6eed74a02877ee40L29-R33): Changed verbose message to use single quotes for consistency. Updates to data processing: * [`src/functions/public/Git/Get-GitHubGitConfig.ps1`](diffhunk://#diff-dfb306c31ba449aae53bfc9d39801cb64924641ebf9f953e6eed74a02877ee40L43-R63): Replaced the old method of processing git configuration data with a more efficient approach using `ConvertFrom-StringData` and a hashtable to store and return the results. This change also includes masking sensitive information found in the configuration. ## Type of change <!-- Use the check-boxes [x] on the options that are relevant. --> - [ ] 📖 [Docs] - [ ] 🪲 [Fix] - [x] 🩹 [Patch] - [x] ⚠️ [Security fix] - [ ] 🚀 [Feature] - [ ] 🌟 [Breaking change] ## Checklist <!-- Use the check-boxes [x] on the options that are relevant. --> - [x] I have performed a self-review of my own code - [x] I have commented my code, particularly in hard-to-understand areas
1 parent 7521adc commit eca70d0

File tree

2 files changed

+39
-10
lines changed

2 files changed

+39
-10
lines changed

src/functions/public/Git/Get-GitHubGitConfig.ps1

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,11 @@
1313
#>
1414
[OutputType([pscustomobject])]
1515
[CmdletBinding()]
16-
param()
16+
param(
17+
[Parameter()]
18+
[ValidateSet('local', 'global', 'system')]
19+
[string] $Scope = 'local'
20+
)
1721

1822
begin {
1923
$stackPath = Get-PSCallStackPath
@@ -26,7 +30,7 @@
2630
$gitExists = Get-Command -Name 'git' -ErrorAction SilentlyContinue
2731
Write-Debug "GITEXISTS: $gitExists"
2832
if (-not $gitExists) {
29-
Write-Verbose "Git is not installed. Cannot get git configuration."
33+
Write-Verbose 'Git is not installed. Cannot get git configuration.'
3034
return
3135
}
3236

@@ -40,14 +44,23 @@
4044
return
4145
}
4246

43-
git config --local --list | ForEach-Object {
44-
(
45-
[pscustomobject]@{
46-
Name = $_.Split('=')[0]
47-
Value = $_.Split('=')[1]
48-
}
49-
)
47+
$config = @{}
48+
git config --$Scope --list | ConvertFrom-StringData | ForEach-Object {
49+
$config += $_
5050
}
51+
$result = @{}
52+
$config.GetEnumerator() | ForEach-Object {
53+
$name = $_.Key
54+
$value = $_.Value
55+
if ($value -match '(?i)AUTHORIZATION:\s*(?<scheme>[^\s]+)\s+(?<token>.*)') {
56+
$secret = $matches['token']
57+
Add-GitHubMask -Value $secret
58+
}
59+
$result += @{
60+
$name = $value
61+
}
62+
}
63+
[pscustomobject]$result
5164
} catch {
5265
throw $_
5366
}

tests/GitHub.Tests.ps1

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -769,10 +769,26 @@ Describe 'As GitHub Actions (GHA)' {
769769
}
770770
}
771771
Context 'Git' {
772+
It "Get-GitHubGitConfig gets the 'local' (default) Git configuration (GHA)" {
773+
$gitConfig = Get-GitHubGitConfig
774+
Write-Verbose ($gitConfig | Format-List | Out-String) -Verbose
775+
$gitConfig | Should -Not -BeNullOrEmpty
776+
}
777+
It "Get-GitHubGitConfig gets the 'global' Git configuration (GHA)" {
778+
git config --global advice.pushfetchfirst false
779+
$gitConfig = Get-GitHubGitConfig -Scope 'global'
780+
Write-Verbose ($gitConfig | Format-List | Out-String) -Verbose
781+
$gitConfig | Should -Not -BeNullOrEmpty
782+
}
783+
It "Get-GitHubGitConfig gets the 'system' Git configuration (GHA)" {
784+
$gitConfig = Get-GitHubGitConfig -Scope 'system'
785+
Write-Verbose ($gitConfig | Format-List | Out-String) -Verbose
786+
$gitConfig | Should -Not -BeNullOrEmpty
787+
}
772788
It 'Set-GitHubGitConfig sets the Git configuration (GHA)' {
773789
{ Set-GitHubGitConfig } | Should -Not -Throw
774790
$gitConfig = Get-GitHubGitConfig
775-
Write-Verbose ($gitConfig | Format-Table | Out-String) -Verbose
791+
Write-Verbose ($gitConfig | Format-List | Out-String) -Verbose
776792

777793
$gitConfig | Should -Not -BeNullOrEmpty
778794
$gitConfig.'user.name' | Should -Not -BeNullOrEmpty

0 commit comments

Comments
 (0)