Repository navigation
Privacy Leakage: feed password may be revealed in output #1224
Description
When paket fails it may leak the user's password in the output:
Paket failed with:
Could not find versions for package SomePackageName in any of the sources in [Nuget
{Url =
"https://feed-url";
Authentication = Some (ConfigAuthentication ("user name","actual password"));}].
We may want to skip printing the actual password there.
Activity
forki commentedon Nov 16, 2015
Yes we need to implement tostring for the Auth type. Care to send a PR?
cdrnet commentedon Nov 16, 2015
Sure. Would it also make sense to use
SecureStringinstead ofStringfor the password?forki commentedon Nov 16, 2015
I guess it could be done, but most of the the passwords can be found on
your system (often in deps file) anyway.
On Nov 16, 2015 8:43 AM, "Christoph Ruegg" notifications@github.com wrote:
cdrnet commentedon Nov 16, 2015
Fair enough, I'll just open a PR for ToString of Credentials etc for now. Thanks.
PackageSources: do not print feed password to output when failing to …
Merge pull request #1238 from cdrnet/dont-leak-password