search

MCFX2 / svn-utilities

Some convenient SVN commandline utilities I've been working on.
MIT License
0 stars 0 forks source link

Improve security for credential storage #5

Open MCFX2 opened 3 years ago

MCFX2 commented 3 years ago

The svn commandline tool has a huge problem. Basically, it will "forget" credentials after the first time they're used in a script and assume --non-interactive until the script completes. If the user has no credential store configured (most users) then it will simply automatically fail due to lack of credentials.

At the moment, this isn't a huge problem as most commands only rely on a single svn call, however a couple (especially svn-generate-code-review) rely on multiple SVN commands. The workaround these use is prompting the user for their password using read -p and then passing the password to SVN directly (with svn -p), effectively bypassing the non-configured password storage mechanism.

This is a really bad practice, and introduces a lot of bad security issues.

MCFX2 commented 3 years ago

After thinking it over and talking to Kai, I've decided to handle this with the current read-based approach, however I still need to clean up the stored password as it can be recovered after the script is run at the moment.