search

praetorian-inc / noseyparker

Nosey Parker is a command-line program that finds secrets and sensitive information in textual data and Git history.
Apache License 2.0
1.56k stars 77 forks source link

General support - PATs in git password field #194

Closed praetorian-harry closed 3 weeks ago

praetorian-harry commented 3 weeks ago

This small PR modifies the git credential helper to pass the PAT stored in the $NP_GITHUB_TOKEN env variable as the git password field rather than the username. In my testing, this change makes it possible to clone private GitLab repos with the --git-url argument as long as the GitLab PAT is set in the $NP_GITHUB_TOKEN env variable.

My testing also shows that cloning private GitHub repos with the --git-url argument still works as expected after this change.

praetorian-harry commented 3 weeks ago

yep, GitLab docs are clear that username doesn't matter as long as it's non-empty: https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html#clone-repository-using-personal-access-token

GitHub docs seem to encourage you to use your username, but it doesn't seem to matter. We saw this before since it worked with the PAT in the username and a blank password. https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#using-a-personal-access-token-on-the-command-line