search

eclipse-equinox / equinox

equinox
Eclipse Public License 2.0
28 stars 60 forks source link

@user.home can be used in -eclipse.keyring argument but not with -eclipse.password. #652

Closed mPorhel closed 2 days ago

mPorhel commented 3 days ago

-eclipse.keyring and -eclipse.password runtime options can be used to change the location of the secure storage and bypass the password provider mecanism.

They are handled in org.eclipse.equinox.internal.security.storage.SecurePreferencesMapper::open. @user.home is replaced with the corresponding value.path during retrieval of the secure storage / keyring file in content in SecurePreferencesMapper::getKeyringFile but not in password file retrieval in SecurePreferencesMapper::processPassword

The documentation of those options clearly indicates that protection of the password file must be considered. Having the possibility to use @user.homecan help to avoid absolute path or computation from user name on the command line if user profile folder is used to store this file (or as indirect mounting point).

@https://help.eclipse.org/latest/index.jsp?topic=%2Forg.eclipse.platform.doc.user%2Freference%2Fref-securestorage-options.htm

Password file The password provider mechanism can be bypassed if you specify the "-eclipse.password " runtime option. In this case the contents of the file you specified as the argument will be used as a master password. While this option is valuable in some circumstances (such as headless applications), the protection of the password file becomes a consideration. The password file can be protected by the operating system access rights and/or by placing it on a removable storage, such as a USB key.

HannesWell commented 2 days ago

Fixed with https://github.com/eclipse-equinox/equinox/pull/653

Thank you @mPorhel for providing a fix. Much appreciated.