chocolatey / ChocolateyGUI

A delicious GUI for Chocolatey
https://docs.chocolatey.org/en-us/chocolatey-gui/
Apache License 2.0
1.65k stars 251 forks source link

(#1000) Do not display sensitive persisted package arguments #1002

Closed gep13 closed 1 year ago

gep13 commented 1 year ago

Description Of Changes

When the ability to show remembered arguments in Chocolatey GUI was first introduced, code from the set_package_config_for_upgrade (which was renamed to SetConfigFromRememberedArguments) method was borrowed, as it was doing very similar work. However, the code that was brought over to Chocolatey GUI failed to realise that after splitting the arguments on " --", when passed into the arguments_contain_sensitive_information (which was renamed to SensitiveArgumentsProvided) that a sensitive variable would no longer be detected as this method expects that all arguments under test start with a "-".

Motivation and Context

Ensure that no sensitive persisted arguments are displayed through Chocolatey GUI.

Testing

  1. Enable the Chocolatey feature to use remembered arguments
  2. Install a package using Chocolatey CLI where a sensitive argument is passed in, for example `choco install packageA --user=bob --password=bill"
  3. Open Chocolatey GUI and open the details window for the package that you just installed
  4. Click the "View Package Arguments" button
  5. Ensure that the value of the password argument is not shown

Operating Systems Testing

Windows 10

Change Types Made

Change Checklist

Related Issue

Fixes #1000

AdmiringWorm commented 1 year ago

@gep13 great work on getting this updated