CLI leaks initial password into console

civo / cli-rubygem

Command line interface for interacting with Civo's cloud API

https://www.civo.com

MIT License

15 stars 4 forks source link

CLI leaks initial password into console #17

Closed alexellis closed 5 years ago

alexellis commented 5 years ago

The CLI is currently leaking confidential data, i.e. the initial password.

This means it cannot be used in automation jobs or CI/CD.

Suggested fix:

don't display this data
add a specific flag to show it --show-passwords

Screenshot 2019-07-10 at 19 54 54

Example test job: https://travis-ci.org/alexellis/civo-prod-app/builds/556941496?utm_source=github_status&utm_medium=notification

andyjeffries commented 5 years ago

I'd actually prefer this to be a separate command and removed from the general show command:

$ civo instance password gitops-prod
YmnU8fQ0VZpIlrRS

kaihoffman commented 5 years ago

Will implement.

andyjeffries commented 5 years ago

Building off that simple command (and the public-ip one) - https://github.com/civo/cli/issues/18 - we should have a -q that just returns the field value, but by default it gives nice (colour coded) output.

kaihoffman commented 5 years ago

And just to confirm, remove instance.initial_password from instance show entirely?

kaihoffman commented 5 years ago

https://github.com/civo/cli/commit/982ba498e1d2c699839de2a04bd7684c933bb558 implements password and removes from show