fix(W-18094367): remove support for .netrc files #170
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| { | ||
| "cSpell.words": [ | ||
| "herokurc", | ||
| "yubikey" | ||
| ] | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,118 @@ | ||
| const fs = require('fs') | ||
| const os = require('os') | ||
| const path = require('path') | ||
| /** | ||
| * List of Heroku machines to remove from the .netrc file | ||
| * as they are no longer used and pose a security risk. | ||
| * | ||
| * Add any additional Heroku machines to this list that you | ||
| * want to remove from the .netrc file. | ||
| */ | ||
| const machinesToRemove = ['api.heroku.com', 'git.heroku.com', 'api.staging.herokudev.com'] | ||
| /** | ||
| * Removes the unencrypted Heroku entries from the .netrc file | ||
| * This is a mitigation for a critical security vulnerability | ||
| * where unencrypted Heroku API tokens could be leaked | ||
| * if the .netrc file is compromised. This function removes | ||
| * any entries related to Heroku from the .netrc file as Heroku | ||
| * has discontinued it's use. | ||
| * | ||
| * BE ADVISED: a defect exists in the original implementation | ||
| * where orphaned credentials (passwords without machine blocks) | ||
| * are created when attempting to delete machine entries using the | ||
| * netrc-parser library. | ||
| * | ||
| * This implementation corrects that issue by removing orphaned | ||
| * credentials as well. | ||
| * | ||
| * @returns {void} | ||
| */ | ||
| function removeUnencryptedNetrcMachines() { | ||
| try { | ||
| const netrcPath = getNetrcFileLocation() | ||
|
|
||
| if (!fs.existsSync(netrcPath)) { | ||
| console.log('.netrc file not found, nothing to clean up') | ||
| return | ||
| } | ||
|
|
||
| const content = fs.readFileSync(netrcPath, 'utf8') | ||
| const lines = content.split('\n') | ||
| const filteredLines = [] | ||
| let skipLines = false | ||
|
|
||
| // Iterate through lines, handling machine blocks and orphaned credentials | ||
| for (const line of lines) { | ||
| const trimmedLine = line.trim().toLowerCase() | ||
|
|
||
| // Check if we're starting a Heroku machine block | ||
| if (trimmedLine.startsWith('machine') && | ||
| (machinesToRemove.some(machine => trimmedLine.includes(machine)))) { | ||
| skipLines = true | ||
| continue | ||
| } | ||
|
|
||
| // Check if we're starting a new machine block (non-Heroku) | ||
| if (trimmedLine.startsWith('machine') && !skipLines) { | ||
| skipLines = false | ||
| } | ||
|
|
||
| // Check for orphaned Heroku passwords (HKRU-) and their associated usernames | ||
| if (/(HRKUSTG-|HKRU-)/.test(line)) { | ||
| // Remove the previous line if it exists (username) | ||
| if (filteredLines.length > 0) { | ||
| filteredLines.pop() | ||
| } | ||
|
|
||
| continue | ||
| } | ||
|
|
||
| // Only keep lines if we're not in a Heroku block | ||
| if (!skipLines) { | ||
| filteredLines.push(line) | ||
| } | ||
| } | ||
|
|
||
| // Remove any trailing empty lines | ||
| while (filteredLines.length > 0 && !filteredLines[filteredLines.length - 1].trim()) { | ||
| filteredLines.pop() | ||
| } | ||
|
|
||
| // Add a newline at the end if we have content | ||
| const outputContent = filteredLines.length > 0 ? | ||
| filteredLines.join('\n') + '\n' : | ||
| '' | ||
|
|
||
| fs.writeFileSync(netrcPath, outputContent) | ||
| } catch (error) { | ||
| throw new Error(`Error cleaning up .netrc: ${error.message}`) | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * Finds the absolute path to the .netrc file | ||
| * on disk based on the operating system. This | ||
| * code was copied directly from `netrc-parser` | ||
| * and optimized for use here. | ||
| * | ||
| * @see [netrc-parser](https://github.com/jdx/node-netrc-parser/blob/master/src/netrc.ts#L177) | ||
| * | ||
| * @returns {string} the file path of the .netrc on disk. | ||
| */ | ||
| function getNetrcFileLocation() { | ||
| let home = '' | ||
| if (os.platform() === 'win32') { | ||
| home = | ||
| process.env.HOME ?? | ||
| (process.env.HOMEDRIVE && process.env.HOMEPATH && path.join(process.env.HOMEDRIVE, process.env.HOMEPATH)) ?? | ||
| process.env.USERPROFILE | ||
| } | ||
|
|
||
| if (!home) { | ||
| home = os.homedir() ?? os.tmpdir() | ||
| } | ||
|
|
||
| return path.join(home, os.platform() === 'win32' ? '_netrc' : '.netrc') | ||
| } | ||
|
|
||
| removeUnencryptedNetrcMachines() | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it's fine to include the code for deleting the old cleartext Netrc entries, but I do not agree that it should be automatically run on the initial release of the new storage mechanism. Let's put the activation/calls to
removeUnencryptedNetrcMachines()in a subsequent PR that can be released in a patch version after the major release.If initial release of the new storage mechanism breaks something for a customer, they need to be able to CLI update back to the previous CLI version to restore functionality.