search

edmundmok / mealpy

Order your meals on MealPal automatically!
MIT License
28 stars 22 forks source link

Credentials should not be requested at module level #10

Closed ipwnponies closed 5 years ago

ipwnponies commented 5 years ago

https://github.com/edmundmok/mealpy/blob/2e355917c454d18071eb4fea35386e905f36429f/mealpy.py#L110-L114

The credentials are only needed for login (one place) and only the http session cookie is persisted afterwards. These variables are in global namespace and are going to linger around longer than wanted. ~Probably even possible to inspect and pull values from a long-live scheduled process.~ Edit: this is non-security concern, discussed a bit in #15. Basically, this is no worse than using keyring or reading password from OS env or file on disk.

ipwnponies commented 5 years ago

This might be non-issue depending on implementation of #6. Should look into that issue first and see how much work it is.

ipwnponies commented 5 years ago

Minor note, this makes testing (#14) difficult, since the input() is invoked upon module import. The fix for that is to conditionally call the logic under if __name__ == '__main__': run block.

ipwnponies commented 5 years ago

Fixed by #18 and #15. The user prompts are limited to __main__ block so it's no longer import-level side-effect. It's now importable for testing purposes!