Closed prjemian closed 2 years ago
Use of the token supplied by -t
is shallow (limited to the punx.main
module) and not propagated further. By the time it is needed later, to actually download content, it appears to be forgotten.
From a security view, it is best not to keep the token in memory any longer than necessary and the code appears to favor this consideration. The token is used here: https://github.com/prjemian/punx/blob/f7e8a129d107c9dd8b45dabd94bd7c04c49b07e0/punx/main.py#L274-L276
Interesting, this code does not check the environment if the -t
option is not used. This is a second BUG (of omission, this time).
Note, that in line 280 here, force=True
will always be the case due to the test at line 274. https://github.com/prjemian/punx/blob/f7e8a129d107c9dd8b45dabd94bd7c04c49b07e0/punx/main.py#L274-L280
Is it possible to update the cache without a GitHub API token? Might be possible by downloading a ZIP of the file_set
and removing the unnecessary content.
Fixed in #188
The
update
subcommand expects a GitHub token to be provided either via an environment variable (GH_TOKEN
orGITHUB_TOKEN
) or via a command-line option-t
. In the latter case, a warning is issued when the-t
option is used (with accompanying token) but no environment variable is found:This is a BUG.