Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

config:edit leaves temporary config vars file around after Ctrl+C #1997

Open
edmorley opened this issue May 4, 2022 · 1 comment
Open

config:edit leaves temporary config vars file around after Ctrl+C #1997

edmorley opened this issue May 4, 2022 · 1 comment

Comments

@edmorley
Copy link
Member

edmorley commented May 4, 2022

Do you want to request a feature or report a bug?

Bug

What is the current behavior?

If I use heroku config:edit and change my mind about editing config vars, and Ctrl+C the CLI command rather than first closing the editor with no changes, then the temporary file that holds the env vars/secrets is left on disk in tmp, which is a security risk.

This is using macOS 12.3.1 with Homebrew bash.

What is the expected behavior?

That the temp file containing the env vars is deleted even if I Ctrl+C the command before closing the editor.

It seems this could be fixed by enabling tmp's graceful cleanup option:
https://www.npmjs.com/package/tmp#graceful-cleanup
https://github.com/jdxcode/edit-string/blob/2105f5ba946d9eb3cf34b23c91a2e73442f63360/src/edit.ts

Called via:

const s = await editor.edit(configToString(original), {prefix, postfix: '.sh'})

@sbosio
Copy link
Contributor

sbosio commented Jul 1, 2024

Added backlog item for fixing this.

GUS Work Item (Heroku internal).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants