ci: do not use shell to expand secure tokens to prevent leaks

mhevery · chuckjaz · commit abbbb4d52c01 · 2017-03-14T10:27:56.000-07:00
diff --git a/scripts/ci/publish-build-artifacts.sh b/scripts/ci/publish-build-artifacts.sh
@@ -75,11 +75,10 @@ function publishRepo {
     done
 
     (
-      # SECURITY CRITICAL: DO NOT remove the set -x on the following line. Removing it will leak the github credentials to the travis log.
-      set -x
       cd $REPO_DIR && \
       git config credential.helper "store --file=.git/credentials" && \
-      echo "https://${GITHUB_TOKEN_ANGULAR}:@github.com" > .git/credentials
+      # SECURITY CRITICAL: DO NOT use shell to expand vars since it could be logged and leaked.
+      node -e "console.log('https://'+process.env.GITHUB_TOKEN_ANGULAR+':github.com')" > .git/credentials
     )
   fi
   echo `date` > $REPO_DIR/BUILD_INFO

Original file line number	Diff line number	Diff line change
`@@ -75,11 +75,10 @@ function publishRepo {`
`75`	`75`	`done`
`76`	`76`
`77`	`77`	`(`
`78`		`- # SECURITY CRITICAL: DO NOT remove the set -x on the following line. Removing it will leak the github credentials to the travis log.`
`79`		`- set -x`
`80`	`78`	`cd $REPO_DIR && \`
`81`	`79`	`git config credential.helper "store --file=.git/credentials" && \`
`82`		`- echo "https://${GITHUB_TOKEN_ANGULAR}:@github.com" > .git/credentials`
	`80`	`+ # SECURITY CRITICAL: DO NOT use shell to expand vars since it could be logged and leaked.`
	`81`	`+ node -e "console.log('https://'+process.env.GITHUB_TOKEN_ANGULAR+':github.com')" > .git/credentials`
`83`	`82`	`)`
`84`	`83`	`fi`
`85`	`84`	echo `date` > $REPO_DIR/BUILD_INFO