Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: newline issue with create-ghcr-regcred #204

Merged
merged 1 commit into from
Nov 20, 2024

Conversation

venkatamutyala
Copy link
Contributor

@venkatamutyala venkatamutyala commented Nov 20, 2024

PR Type

bug_fix


Description

  • Fixed a newline issue in the create-ghcr-regcred.sh script by ensuring the base64 encoding does not include line breaks.
  • Modified the script to output JSON without a trailing newline, ensuring compatibility with systems expecting a single-line JSON string.

Changes walkthrough 📝

Relevant files
Bug fix
create-ghcr-regcred.sh
Fix newline issue in GHCR credential creation script         

.devcontainer/tools/create-ghcr-regcred.sh

  • Fixed newline issue by using base64 -w0 for encoding.
  • Modified output to avoid trailing newline with echo -n.
  • +2/-2     

    💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

    Copy link

    PR Reviewer Guide 🔍

    Here are some key observations to aid the review process:

    ⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪
    🧪 No relevant tests
    🔒 Security concerns

    Sensitive information exposure:
    The script handles GitHub credentials (username and token). While the changes themselves don't introduce new vulnerabilities, ensure the base64 encoded credentials are transmitted and stored securely, and that the token has appropriate minimal permissions.

    ⚡ Recommended focus areas for review

    Validation Check
    Verify that the base64 encoding without line breaks (-w0) works correctly across different platforms/environments, as base64 options can vary between systems

    Copy link

    PR Code Suggestions ✨

    Explore these optional code suggestions:

    CategorySuggestion                                                                                                                                    Score
    Security
    Prevent command injection vulnerabilities by properly quoting command substitution output

    Add quotes around the base64-encoded credentials to prevent potential command
    injection if the input contains special characters that could be interpreted by the
    shell.

    .devcontainer/tools/create-ghcr-regcred.sh [45]

    -b64_enc_regcred=$(echo -n "$gh_username:$gh_token" | base64 -w0)
    +b64_enc_regcred="$(echo -n "$gh_username:$gh_token" | base64 -w0)"
    • Apply this suggestion
    Suggestion importance[1-10]: 9

    Why: This is a critical security improvement that prevents potential command injection vulnerabilities when handling user-provided credentials. Without proper quoting, malicious input could lead to shell command injection.

    9

    💡 Need additional feedback ? start a PR chat

    @venkatamutyala venkatamutyala merged commit 322b59c into main Nov 20, 2024
    3 checks passed
    @venkatamutyala venkatamutyala deleted the fix-newline-issue-with-create-ghcr-regcred branch November 20, 2024 14:33
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Projects
    None yet
    Development

    Successfully merging this pull request may close these issues.

    3 participants