Provide support script for adding new test subject #817
Conversation
Resolves #816 Signed-off-by: Matthias Büchse <[email protected]>
Signed-off-by: Matthias Büchse <[email protected]>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| token = base64.b64encode(f"{subject}:{password}".encode('utf-8')) | ||
| hash_ = CRYPTCTX.hash(password) | ||
| with open(tokenfile_path, "wb") as fileobj: | ||
| fileobj.write(token) |
Check failure
Code scanning / CodeQL
Clear-text storage of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 8 days ago
To fix the problem, we need to ensure that the password is encrypted before being stored in the token file. We can use the cryptography library to encrypt the password before encoding it in base64 and writing it to the file. This will ensure that the password is not stored in clear text.
- Import the necessary modules from the
cryptographylibrary. - Generate a key for encryption.
- Encrypt the password using the generated key.
- Encode the encrypted password in base64 and store it in the token file.
| @@ -8,2 +8,3 @@ | ||
| import base64 | ||
| from cryptography.fernet import Fernet | ||
| import getpass | ||
| @@ -50,3 +51,6 @@ | ||
| print("No match. Try again...") | ||
| token = base64.b64encode(f"{subject}:{password}".encode('utf-8')) | ||
| key = Fernet.generate_key() | ||
| cipher_suite = Fernet(key) | ||
| encrypted_password = cipher_suite.encrypt(password.encode('utf-8')) | ||
| token = base64.b64encode(f"{subject}:{encrypted_password.decode('utf-8')}".encode('utf-8')) | ||
| hash_ = CRYPTCTX.hash(password) | ||
| @@ -54,2 +58,4 @@ | ||
| fileobj.write(token) | ||
| fileobj.write(b'\n') | ||
| fileobj.write(key) | ||
| print("Creating key file using `ssh-keygen`...") |
There was a problem hiding this comment.
Erm what? And the key? Where am I storing the key???
There was a problem hiding this comment.
Without spending an hour to understand what's required here, I can not comment on this, sorry.
If we can avoid storing sensitive data in plaintext, we should of course. I have no idea whether or not that is possible without major effort. If we need to store it, we should adjust the permissions / umask to 0600 (rw-------).
Signed-off-by: Matthias Büchse <[email protected]>
| print(str(e), file=sys.stderr) | ||
| sys.exit(1) | ||
| except KeyboardInterrupt: | ||
| print("Interrupted", file=sys.stderr) |
There was a problem hiding this comment.
Add sys.exit(128+signal.SIGINT) here?
(Needs an import signal then of course.)
This would make the exit code the same that you get if you did not catch the exception ...
Resolves #816