(#1000) Do not display sensitive persisted package arguments #1002
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When the ability to show remembered arguments in Chocolatey GUI was first introduced, code from the set_package_config_for_upgrade (which was renamed to SetConfigFromRememberedArguments) method was borrowed, as it was doing very similar work. However, the code that was brought over to Chocolatey GUI failed to realise that after splitting the arguments on " --", when passed into the arguments_contain_sensitive_information (which was renamed to SensitiveArgumentsProvided) that a sensitive variable would no longer be detected as this method expects that all arguments under test start with a "-". Without a major refactoring of how this works, the simplest way is to put "--" back on the start of each argument, before passing into the arguments_contain_sensitive_information method, that way, it will correctly return whether it is a sensitive argument or not. There is a larger discussion around whether a sensitive argument should be persisted or not, but that is otwith the scope of this change.
All of these methods have been marked as obsolete in Chocolatey codebase, so switched to using the newly named versions.
10 tasks
gep13
changed the title
|
@gep13 great work on getting this updated |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description Of Changes
When the ability to show remembered arguments in Chocolatey GUI was
first introduced, code from the set_package_config_for_upgrade (which
was renamed to SetConfigFromRememberedArguments) method was borrowed,
as it was doing very similar work. However, the code that was brought
over to Chocolatey GUI failed to realise that after splitting the
arguments on " --", when passed into the
arguments_contain_sensitive_information (which was renamed to
SensitiveArgumentsProvided) that a sensitive variable would no longer
be detected as this method expects that all arguments under test start
with a "-".
Motivation and Context
Ensure that no sensitive persisted arguments are displayed through Chocolatey GUI.
Testing
Operating Systems Testing
Windows 10
Change Types Made
Change Checklist
Related Issue
Fixes #1000