dscotese / kraken-grid

A bot that extends grid trading once you use it to create a grid.
GNU General Public License v3.0
9 stars 7 forks source link

Information leak to filesystem of machine running bot #32

Closed dscotese closed 1 month ago

dscotese commented 1 year ago

If you enter a command the bot doesn't understand, it asks "Try [first word of whatever you entered] raw?" and you'd answer N, n, no, or something that doesn't start with a y (see the code, as that's what it checks). That should be all that happens but I wanted to make it easy to set debugging flags, for example to make the bot console.log the arguments to any function call, so after you enter N, the bot sets (and tells you it set) process.TESTING to that first word. It also turns on caching under the assumption that you want to test and don't need to wait for realtime replies from the exchange.

When caching is on, testFasterCache will store files containing the raw responses from the exchange in filenames made of the date and time at which this instance of the bot started. It's very handy for me, but the rationale for entering a password when it starts is that you if anyone gets ahold of your machine (or just the disk drive), they can mess with your exchange account if the bot isn't password protected. The caching doesn't completely destroy this protection, but it weakens it because anything you get from the exchange server after process.TESTING is set to anything that evaluates to true (like function names as mentioned previously) will be stored on disk in cleartext. The elegant way to fix this is to separate caching from the truthiness of process.TESTING and use only the process.USECACHE value (which I also added, but setting process.TESTING to anything other than "nocache" also turns on the cache).

A simple way to fix this is to require an esoteric answer to make it do what I want. "Try X raw?" could be answered with something that doesn't start with y, but the code could leave process.TESTING alone unless the answer is recognizable... 'ucft' for "Use cache for testing" 'twnc' for "Test with no caching."

dscotese commented 1 month ago

If you mistyped a command, extending the work required to fix it would serve to train you to type more carefully. For this reason, I think a better solution than esoteric answers is more questions: "Try X raw" (/^[^yY]/) "Set Process Testing to X?" (/^[yY]/) "Enable Caching?" If the answer doesn't match the regexp, then the code knows what to do. Otherwise, all the questions are answered, the code is set as you want it set, and you will be more careful typing commands.

dscotese commented 1 month ago

This was fixed with #46