Skip to content

Commit a57b082

Browse files
jamie-patejamie-pate
committed
Don't write payloads to disk, they may contain sensitive info.
Signed-off-by: Jamie Pate <jpate@fortinet.com>
1 parent e29d794 commit a57b082

4 files changed

Lines changed: 84 additions & 90 deletions

File tree

‎assets/check‎

Lines changed: 19 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -11,27 +11,25 @@ source $(dirname $0)/common.sh
1111
# for jq
1212
PATH=/usr/local/bin:$PATH
1313

14-
payload=$TMPDIR/git-resource-request
15-
16-
cat > $payload <&0
17-
18-
load_pubkey $payload
19-
configure_https_tunnel $payload
20-
configure_git_ssl_verification $payload
21-
configure_credentials $payload
22-
23-
uri=$(jq -r '.source.uri // ""' < $payload)
24-
branch=$(jq -r '.source.branch // ""' < $payload)
25-
paths="$(jq -r '(.source.paths // ["."])[]' < $payload)" # those "'s are important
26-
ignore_paths="$(jq -r '":!" + (.source.ignore_paths // [])[]' < $payload)" # these ones too
27-
tag_filter=$(jq -r '.source.tag_filter // ""' < $payload)
28-
tag_regex=$(jq -r '.source.tag_regex // ""' < $payload)
29-
git_config_payload=$(jq -r '.source.git_config // []' < $payload)
30-
ref=$(jq -r '.version.ref // ""' < $payload)
31-
skip_ci_disabled=$(jq -r '.source.disable_ci_skip // false' < $payload)
32-
filter_whitelist=$(jq -r '.source.commit_filter.include // []' < $payload)
33-
filter_blacklist=$(jq -r '.source.commit_filter.exclude // []' < $payload)
34-
version_depth=$(jq -r '.source.version_depth // 1' < $payload)
14+
payload="$(cat <&0)"
15+
16+
load_pubkey "$payload"
17+
configure_https_tunnel "$payload"
18+
configure_git_ssl_verification "$payload"
19+
configure_credentials "$payload"
20+
21+
uri=$(jq -r '.source.uri // ""' <<< "$payload")
22+
branch=$(jq -r '.source.branch // ""' <<< "$payload")
23+
paths="$(jq -r '(.source.paths // ["."])[]' <<< "$payload")" # those "'s are important
24+
ignore_paths="$(jq -r '":!" + (.source.ignore_paths // [])[]' <<< "$payload")" # these ones too
25+
tag_filter=$(jq -r '.source.tag_filter // ""' <<< "$payload")
26+
tag_regex=$(jq -r '.source.tag_regex // ""' <<< "$payload")
27+
git_config_payload=$(jq -r '.source.git_config // []' <<< "$payload")
28+
ref=$(jq -r '.version.ref // ""' <<< "$payload")
29+
skip_ci_disabled=$(jq -r '.source.disable_ci_skip // false' <<< "$payload")
30+
filter_whitelist=$(jq -r '.source.commit_filter.include // []' <<< "$payload")
31+
filter_blacklist=$(jq -r '.source.commit_filter.exclude // []' <<< "$payload")
32+
version_depth=$(jq -r '.source.version_depth // 1' <<< "$payload")
3533
reverse=false
3634

3735
configure_git_global "${git_config_payload}"

‎assets/common.sh‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@ export GIT_CRYPT_KEY_PATH=~/git-crypt.key
33

44
load_pubkey() {
55
local private_key_path=$TMPDIR/git-resource-private-key
6-
local private_key_user=$(jq -r '.source.private_key_user // empty' < $1)
7-
local forward_agent=$(jq -r '.source.forward_agent // false' < $1)
8-
local passphrase="$(jq -r '.source.private_key_passphrase // empty' < $1)"
6+
local private_key_user=$(jq -r '.source.private_key_user // empty' <<< "$1")
7+
local forward_agent=$(jq -r '.source.forward_agent // false' <<< "$1")
8+
local passphrase="$(jq -r '.source.private_key_passphrase // empty' <<< "$1")"
99

10-
(jq -r '.source.private_key // empty' < $1) > $private_key_path
10+
(jq -r '.source.private_key // empty' <<< "$1") > $private_key_path
1111

1212
if [ -s $private_key_path ]; then
1313
chmod 0600 $private_key_path
@@ -36,7 +36,7 @@ EOF
3636
}
3737

3838
configure_https_tunnel() {
39-
tunnel=$(jq -r '.source.https_tunnel // empty' < $1)
39+
tunnel=$(jq -r '.source.https_tunnel // empty' <<< "$1")
4040

4141
if [ ! -z "$tunnel" ]; then
4242
host=$(echo "$tunnel" | jq -r '.proxy_host // empty')
@@ -67,7 +67,7 @@ configure_git_global() {
6767
}
6868

6969
configure_git_ssl_verification() {
70-
skip_ssl_verification=$(jq -r '.source.skip_ssl_verification // false' < $1)
70+
skip_ssl_verification=$(jq -r '.source.skip_ssl_verification // false' <<< "$1")
7171
if [ "$skip_ssl_verification" = "true" ]; then
7272
export GIT_SSL_NO_VERIFY=true
7373
fi
@@ -187,23 +187,23 @@ git_metadata() {
187187
configure_submodule_credentials() {
188188
local username
189189
local password
190-
if [[ "$(jq -r '.source.submodule_credentials // ""' < "$1")" == "" ]]; then
190+
if [[ "$(jq -r '.source.submodule_credentials // ""' <<< "$1")" == "" ]]; then
191191
return
192192
fi
193193

194-
for k in $(jq -r '.source.submodule_credentials | keys | .[]' < "$1"); do
195-
host=$(jq -r --argjson k "$k" '.source.submodule_credentials[$k].host // ""' < "$1")
196-
username=$(jq -r --argjson k "$k" '.source.submodule_credentials[$k].username // ""' < "$1")
197-
password=$(jq -r --argjson k "$k" '.source.submodule_credentials[$k].password // ""' < "$1")
194+
for k in $(jq -r '.source.submodule_credentials | keys | .[]' <<< "$1"); do
195+
host=$(jq -r --argjson k "$k" '.source.submodule_credentials[$k].host // ""' <<< "$1")
196+
username=$(jq -r --argjson k "$k" '.source.submodule_credentials[$k].username // ""' <<< "$1")
197+
password=$(jq -r --argjson k "$k" '.source.submodule_credentials[$k].password // ""' <<< "$1")
198198
if [ "$username" != "" -a "$password" != "" -a "$host" != "" ]; then
199199
echo "machine $host login $username password $password" >> "${HOME}/.netrc"
200200
fi
201201
done
202202
}
203203

204204
configure_credentials() {
205-
local username=$(jq -r '.source.username // ""' < $1)
206-
local password=$(jq -r '.source.password // ""' < $1)
205+
local username=$(jq -r '.source.username // ""' <<< "$1")
206+
local password=$(jq -r '.source.password // ""' <<< "$1")
207207

208208
rm -f $HOME/.netrc
209209
configure_submodule_credentials "$1"
@@ -216,7 +216,7 @@ configure_credentials() {
216216
load_git_crypt_key() {
217217
local git_crypt_tmp_key_path=$TMPDIR/git-resource-git-crypt-key
218218

219-
(jq -r '.source.git_crypt_key // empty' < $1) > $git_crypt_tmp_key_path
219+
(jq -r '.source.git_crypt_key // empty' <<< "$1") > $git_crypt_tmp_key_path
220220

221221
if [ -s $git_crypt_tmp_key_path ]; then
222222
cat $git_crypt_tmp_key_path | tr ' ' '\n' | base64 -d > $GIT_CRYPT_KEY_PATH

‎assets/in‎

Lines changed: 30 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -23,41 +23,39 @@ if [ "${bin_dir#/}" == "$bin_dir" ]; then
2323
bin_dir="$PWD/$bin_dir"
2424
fi
2525

26-
payload=$(mktemp $TMPDIR/git-resource-request.XXXXXX)
27-
28-
cat > $payload <&0
29-
30-
load_pubkey $payload
31-
load_git_crypt_key $payload
32-
configure_https_tunnel $payload
33-
configure_git_ssl_verification $payload
34-
configure_credentials $payload
35-
36-
uri=$(jq -r '.source.uri // ""' < $payload)
37-
branch=$(jq -r '.source.branch // ""' < $payload)
38-
git_config_payload=$(jq -r '.source.git_config // []' < $payload)
39-
ref=$(jq -r '.version.ref // "HEAD"' < $payload)
40-
override_branch=$(jq -r '.version.branch // ""' < $payload)
41-
depth=$(jq -r '(.params.depth // 0)' < $payload)
42-
fetch=$(jq -r '(.params.fetch // [])[]' < $payload)
43-
submodules=$(jq -r '(.params.submodules // "all")' < $payload)
44-
submodule_recursive=$(jq -r '(.params.submodule_recursive // true)' < $payload)
45-
submodule_remote=$(jq -r '(.params.submodule_remote // false)' < $payload)
46-
commit_verification_key_ids=$(jq -r '(.source.commit_verification_key_ids // [])[]' < $payload)
47-
commit_verification_keys=$(jq -r '(.source.commit_verification_keys // [])[]' < $payload)
48-
tag_filter=$(jq -r '.source.tag_filter // ""' < $payload)
49-
tag_regex=$(jq -r '.source.tag_regex // ""' < $payload)
50-
fetch_tags=$(jq -r '.params.fetch_tags' < $payload)
51-
gpg_keyserver=$(jq -r '.source.gpg_keyserver // "hkp://ipv4.pool.sks-keyservers.net/"' < $payload)
52-
disable_git_lfs=$(jq -r '(.params.disable_git_lfs // false)' < $payload)
53-
clean_tags=$(jq -r '(.params.clean_tags // false)' < $payload)
54-
short_ref_format=$(jq -r '(.params.short_ref_format // "%s")' < $payload)
55-
timestamp_format=$(jq -r '(.params.timestamp_format // "iso8601")' < $payload)
56-
describe_ref_options=$(jq -r '(.params.describe_ref_options // "--always --dirty --broken")' < $payload)
26+
payload="$(cat <&0)"
27+
28+
load_pubkey "$payload"
29+
load_git_crypt_key "$payload"
30+
configure_https_tunnel "$payload"
31+
configure_git_ssl_verification "$payload"
32+
configure_credentials "$payload"
33+
34+
uri=$(jq -r '.source.uri // ""' <<< "$payload")
35+
branch=$(jq -r '.source.branch // ""' <<< "$payload")
36+
git_config_payload=$(jq -r '.source.git_config // []' <<< "$payload")
37+
ref=$(jq -r '.version.ref // "HEAD"' <<< "$payload")
38+
override_branch=$(jq -r '.version.branch // ""' <<< "$payload")
39+
depth=$(jq -r '(.params.depth // 0)' <<< "$payload")
40+
fetch=$(jq -r '(.params.fetch // [])[]' <<< "$payload")
41+
submodules=$(jq -r '(.params.submodules // "all")' <<< "$payload")
42+
submodule_recursive=$(jq -r '(.params.submodule_recursive // true)' <<< "$payload")
43+
submodule_remote=$(jq -r '(.params.submodule_remote // false)' <<< "$payload")
44+
commit_verification_key_ids=$(jq -r '(.source.commit_verification_key_ids // [])[]' <<< "$payload")
45+
commit_verification_keys=$(jq -r '(.source.commit_verification_keys // [])[]' <<< "$payload")
46+
tag_filter=$(jq -r '.source.tag_filter // ""' <<< "$payload")
47+
tag_regex=$(jq -r '.source.tag_regex // ""' <<< "$payload")
48+
fetch_tags=$(jq -r '.params.fetch_tags' <<< "$payload")
49+
gpg_keyserver=$(jq -r '.source.gpg_keyserver // "hkp://ipv4.pool.sks-keyservers.net/"' <<< "$payload")
50+
disable_git_lfs=$(jq -r '(.params.disable_git_lfs // false)' <<< "$payload")
51+
clean_tags=$(jq -r '(.params.clean_tags // false)' <<< "$payload")
52+
short_ref_format=$(jq -r '(.params.short_ref_format // "%s")' <<< "$payload")
53+
timestamp_format=$(jq -r '(.params.timestamp_format // "iso8601")' <<< "$payload")
54+
describe_ref_options=$(jq -r '(.params.describe_ref_options // "--always --dirty --broken")' <<< "$payload")
5755

5856
# If params not defined, get it from source
5957
if [ -z "$fetch_tags" ] || [ "$fetch_tags" == "null" ] ; then
60-
fetch_tags=$(jq -r '.source.fetch_tags' < $payload)
58+
fetch_tags=$(jq -r '.source.fetch_tags' <<< "$payload")
6159
fi
6260

6361
configure_git_global "${git_config_payload}"

‎assets/out‎

Lines changed: 21 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -18,29 +18,27 @@ fi
1818
# for jq
1919
PATH=/usr/local/bin:$PATH
2020

21-
payload=$(mktemp $TMPDIR/git-resource-request.XXXXXX)
22-
23-
cat > $payload <&0
24-
25-
load_pubkey $payload
26-
configure_https_tunnel $payload
27-
configure_git_ssl_verification $payload
28-
configure_credentials $payload
29-
30-
uri=$(jq -r '.source.uri // ""' < $payload)
31-
branch=$(jq -r '.source.branch // ""' < $payload)
32-
git_config_payload=$(jq -r '.source.git_config // []' < $payload)
33-
repository=$(jq -r '.params.repository // ""' < $payload)
34-
tag=$(jq -r '.params.tag // ""' < $payload)
35-
tag_prefix=$(jq -r '.params.tag_prefix // ""' < $payload)
36-
rebase=$(jq -r '.params.rebase // false' < $payload)
37-
merge=$(jq -r '.params.merge // false' < $payload)
38-
returning=$(jq -r '.params.returning // "merged"' < $payload)
39-
force=$(jq -r '.params.force // false' < $payload)
40-
only_tag=$(jq -r '.params.only_tag // false' < $payload)
41-
annotation_file=$(jq -r '.params.annotate // ""' < $payload)
42-
notes_file=$(jq -r '.params.notes // ""' < $payload)
43-
override_branch=$(jq -r '.params.branch // ""' < $payload)
21+
payload="$(cat <&0)"
22+
23+
load_pubkey "$payload"
24+
configure_https_tunnel "$payload"
25+
configure_git_ssl_verification "$payload"
26+
configure_credentials "$payload"
27+
28+
uri=$(jq -r '.source.uri // ""' <<< "$payload")
29+
branch=$(jq -r '.source.branch // ""' <<< "$payload")
30+
git_config_payload=$(jq -r '.source.git_config // []' <<< "$payload")
31+
repository=$(jq -r '.params.repository // ""' <<< "$payload")
32+
tag=$(jq -r '.params.tag // ""' <<< "$payload")
33+
tag_prefix=$(jq -r '.params.tag_prefix // ""' <<< "$payload")
34+
rebase=$(jq -r '.params.rebase // false' <<< "$payload")
35+
merge=$(jq -r '.params.merge // false' <<< "$payload")
36+
returning=$(jq -r '.params.returning // "merged"' <<< "$payload")
37+
force=$(jq -r '.params.force // false' <<< "$payload")
38+
only_tag=$(jq -r '.params.only_tag // false' <<< "$payload")
39+
annotation_file=$(jq -r '.params.annotate // ""' <<< "$payload")
40+
notes_file=$(jq -r '.params.notes // ""' <<< "$payload")
41+
override_branch=$(jq -r '.params.branch // ""' <<< "$payload")
4442

4543
configure_git_global "${git_config_payload}"
4644

0 commit comments

Comments
 (0)