search

newrelic / nr1-github

NR1 Github allows you to create more context to your entities by having access to the GitHub repository, contributors and README.
https://github.com/newrelic/nr1-github/discussions
Apache License 2.0
19 stars 27 forks source link

fix: remove PAT vulnerability #78

Closed rudouglas closed 3 years ago

rudouglas commented 3 years ago

A user can no longer set a GitHub URL universally, each user must set this individually, and they are stored in that users secrets vault.

This prevents one user from setting the GitHub URL to a fake server, and stealing another users PAT when they use the NerdPack

aswanson-nr commented 3 years ago

I'm worried that this change will drastically affect the usage of this nerdpack. Currently, a single user can set it up for an organization, but if we change that to each member in the organization having to setup it up individually it loses "5 minutes to joy" it may have had. I'd love to have a discussion on these changes, maybe we can loop in @jpvajda in the next day or two.

jpvajda commented 3 years ago

@rudouglas @aswanson-nr What issue does this change relate to, is attempting to resolve a bug? --- adding to our board so we can discuss

rudouglas commented 3 years ago

This is related to #71 which turned out it needed additional work, but i decided to take this on innovation time as I wanted to knock out some of the Feature Requests as well

jpvajda commented 3 years ago

Let's parking lot it today 🅿️

jpvajda commented 3 years ago

I filed this ticket, and we can discuss I am still not 💯 clear on the user exp. change this will introduce so when you have time we can walk through it, just want to ensure I fully understand the change as the nerdpack is interacting with entities, and entities are a 1:1 in terms of accounts. https://github.com/newrelic/nr1-github/issues/79

nr-opensource-bot commented 3 years ago

:tada: This PR is included in version 0.6.14 :tada:

The release is available on GitHub release

Your semantic-release bot :package::rocket:

rudouglas commented 3 years ago

I merged and then the UI updated to show your comments 🤦 will revert and take a look