Security: Looking for Reviewer #18

RobWalt commented 2023年01月29日 12:13:11 +01:00

I'm not to sure with some parts of the app. There are mainly two major things I'd like to be reviewed:

• API endpoint injections: I think we need to do more valdiation on user input
  on some of the commands.
• Credentials: I'm not sure if storing the creadentials in the DATA_DIR is a
  good idea. I haven't found anything on the topic of where they should belong.

Please feel free to contact me if you see any other issues regarding the apps security.

I'm not to sure with some parts of the app. There are mainly two major things I'd like to be reviewed: - API endpoint injections: I think we need to do more valdiation on user input on some of the commands. - Credentials: I'm not sure if storing the creadentials in the `DATA_DIR` is a good idea. I haven't found anything on the topic of where they should belong. Please feel free to contact me if you see any other issues regarding the apps security.

signed commented 2023年08月18日 09:44:55 +02:00

Credentials: I'm not sure if storing the creadentials in the DATA_DIR is a good idea. I haven't found anything on the topic of where they should belong.

For reference, gh (Github's CLI) stores its tokens by default, before storing in files, in :

• macOS Keychain
• Gnome Secret Service
• Wincred for Windows

This has the advantage that it is encrypted, but :

• Headless systems (especially Linux) are unlikely to support Gnome SS
• They don't support KDE Kwallet

---

In the matters of libraries, there is :

• secret-service-rs
• apple-security-sys
• winapi has bindings for wincred

KWallet is specific in that it has quite a new and broken support for the SS API see this, and would prefer its own API for the time being... The main issue with this one is that there are no ready-made rust KWallet APIs

> Credentials: I'm not sure if storing the creadentials in the DATA_DIR is a good idea. I haven't found anything on the topic of where they should belong. For reference, [`gh`](https://github.com/cli/cli/releases/tag/v2.24.0) (Github's CLI) stores its tokens by default, before storing in files, in : - macOS Keychain - Gnome Secret Service - Wincred for Windows This has the advantage that it is encrypted, but : - Headless systems (especially Linux) are unlikely to support Gnome SS - They don't support KDE Kwallet ---- In the matters of libraries, there is : - [secret-service-rs](https://github.com/hwchen/secret-service-rs) - [apple-security-sys](https://lib.rs/crates/apple-security-sys) - [winapi](https://lib.rs/crates/winapi) has bindings for wincred KWallet is specific in that it has quite a new and broken support for the SS API [see this](https://github.com/frankosterfeld/qtkeychain/pull/221#issuecomment-1241144580), and would prefer its own API for the time being... The main issue with this one is that there are no ready-made rust KWallet APIs

Aviac commented 2025年09月16日 22:03:55 +02:00

I think this can be closed for now

I think this can be closed for now