Currently, gitlab.nvim passes its configuration JSON (which contains the auth_token) directly
to the Go server binary via a command-line argument when calling vim.system().
Because command-line arguments are globally visible on UNIX systems via ps or pgrep, any user
on the machine can easily read the GitLab API token just by listing running processes.
Additionally, if Neovim is closed forcefully or quickly (e.g. via scripts or aliases), the Go
server processes aren't killed and become orphaned zombies running in the background. Because
they pile up, it becomes very easy to accidentally spot the leaked token in pgrep -fl nvim outputs.
➜ pgrep -fl nvim
2080 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"gitlab_url":"https://xxxxxxxxxxxxxxx.com","connection_settings":{"insecure":false,"proxy":"","remote":"origin"},"debug":{"response":false,"request":false,"gitlab_request":false,"gitlab_response":false},"port":54232,"chosen_mr_iid":0,"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","auth_token":"xxxxxxxxxxxxxxxxx"}
21519 nvim . .
21544 nvim --embed . .
66859 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"chosen_mr_iid":4143,"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","auth_token":"xxxxxxxxxxxxxxxxx","gitlab_url":"https://xxxxxxxxxxxxxxx.com","debug":{"request":false,"gitlab_request":false,"gitlab_response":false,"response":false},"connection_settings":{"proxy":"","remote":"origin","insecure":false},"port":51887}
83060 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"debug":{"gitlab_request":false,"gitlab_response":false,"response":false,"request":false},"connection_settings":{"remote":"origin","proxy":"","insecure":false},"port":0,"chosen_mr_iid":0,"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","auth_token":"xxxxxxxxxxxxxxxxx","gitlab_url":"https://xxxxxxxxxxxxxxx.com"}
84503 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"debug":{"gitlab_request":false,"gitlab_response":false,"response":false,"request":false},"connection_settings":{"remote":"origin","proxy":"","insecure":false},"port":0,"chosen_mr_iid":0,"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","auth_token":"xxxxxxxxxxxxxxxxx","gitlab_url":"https://xxxxxxxxxxxxxxx.com"}
91585 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","port":0,"gitlab_url":"https://xxxxxxxxxxxxxxx.com","debug":{"request":false,"gitlab_request":false,"gitlab_response":false,"response":false},"connection_settings":{"insecure":false,"proxy":"","remote":"origin"},"auth_token":"xxxxxxxxxxxxxxxxx","chosen_mr_iid":0}
95389 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"chosen_mr_iid":0,"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","auth_token":"xxxxxxxxxxxxxxxxx","debug":{"gitlab_response":false,"response":false,"request":false,"gitlab_request":false},"gitlab_url":"https://xxxxxxxxxxxxxxx.com","connection_settings":{"proxy":"","insecure":false,"remote":"origin"},"port":0}
97335 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"debug":{"response":false,"request":false,"gitlab_request":false,"gitlab_response":false},"chosen_mr_iid":0,"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","auth_token":"xxxxxxxxxxxxxxxxx","gitlab_url":"https://xxxxxxxxxxxxxxx.com","connection_settings":{"insecure":false,"remote":"origin","proxy":""},"port":0}
The configuration JSON (or at least the auth_token) should be passed to the Go server via stdin
or as an environment variable, rather than as a command-line argument. Additionally, it would
be great if the plugin ensured the server process is killed properly upon VimLeavePre.
Prerequsities
:h gitlab.nvim.troubleshootingand followed the steps thereSetup Configuration and Environment
NVIM v0.12.4
Build type: Release
LuaJIT 2.1.1784580905
Vim versions: 8.1, 8.2, 9.0, 9.1, 9.2
system vimrc file: "$VIM/sysinit.vim"
fall-back for $VIM: "/usr/local/Cellar/neovim/0.12.4/share/nvim"
Bug Description
Currently, gitlab.nvim passes its configuration JSON (which contains the auth_token) directly
to the Go server binary via a command-line argument when calling vim.system().
Because command-line arguments are globally visible on UNIX systems via ps or pgrep, any user
on the machine can easily read the GitLab API token just by listing running processes.
Additionally, if Neovim is closed forcefully or quickly (e.g. via scripts or aliases), the Go
server processes aren't killed and become orphaned zombies running in the background. Because
they pile up, it becomes very easy to accidentally spot the leaked token in pgrep -fl nvim outputs.
Reproduction Steps
Screenshots
Suggested Fix
The configuration JSON (or at least the auth_token) should be passed to the Go server via stdin
or as an environment variable, rather than as a command-line argument. Additionally, it would
be great if the plugin ensured the server process is killed properly upon VimLeavePre.