Composer leaks contents of tokens configured as GitHub OAuth tokens
1–10 of 29 posts
Re: Composer leaks contents of tokens configured as GitHub OAuth tokens
#2I was the reporter on this one. If you have Github Actions in your organization, disable them immediately if you're unsure which version of composer your Github Actions run.
Re: Composer leaks contents of tokens configured as GitHub OAuth tokens
#3GHA have always been a PITA for any serious DevOps; it's quite clear they were designed to integrate in 7 lines of code and then tell everyone who complains that they're doing it wrong.
This does not surprise me.
Re: Composer leaks contents of tokens configured as GitHub OAuth tokens
#4The title suggests it is a Github issue but really it is https://github.com/composer/composer no? I would edit the title for clarity.
Re: Composer leaks contents of tokens configured as GitHub OAuth tokens
#5I was the reporter on this one. If you have Github Actions in your organization, disable them immediately if you're unsure which version of composer your Github Actions run.
Not immediately clear to me, is this limited to ghu_xxx type OAUTH tokens? And it's only relevant for PHP projects that use composer in GHA?
Re: Composer leaks contents of tokens configured as GitHub OAuth tokens
#6The title suggests it is a Github issue but really it is https://github.com/composer/composer no? I would edit the title for clarity.
it's not super clear, but that's my read as well... i think i can start lowering my panic levels now.
Re: Composer leaks contents of tokens configured as GitHub OAuth tokens
#7I was the reporter on this one. If you have Github Actions in your organization, disable them immediately if you're unsure which version of composer your Github Actions run.
Could you elaborate on this bit on why Github's secret masking doesn't work here:
> GitHub Actions' built-in secret masker matches registered values as exact substrings. When the exception message is rendered by Symfony Console it may wrap, embed in In BaseIO.php line N: framing, or interleave with ANSI control sequences. So the masker does not redact, and the plaintext token reaches the log.
What does this log rendering look like such that the token from that code snippet becomes interleaved enough to not be a substring match?
I'm not familiar with composer/Symfony but I would expect something like:
Line 34: Foo bar
Line 34: Foo barRe: Composer leaks contents of tokens configured as GitHub OAuth tokens
#8I was the reporter on this one. If you have Github Actions in your organization, disable them immediately if you're unsure which version of composer your Github Actions run.
Not immediately clear to me, is this limited to ghu_xxx type OAUTH tokens? And it's only relevant for PHP projects that use composer in GHA?
That's my understanding. This seems to only effect PHP projects that use Composer in GitHub actions. Examples being usage of shivammathur/setup-php and or php-actions/composer.
Re: Composer leaks contents of tokens configured as GitHub OAuth tokens
#9GHA have always been a PITA for any serious DevOps; it's quite clear they were designed to integrate in 7 lines of code and then tell everyone who complains that they're doing it wrong. This does not surprise me.
It is a PITA, but that can be significantly improved IMHO if you just write shell script wrappers for your tasks. Not only does it make it easier to run CI locally, but it also makes it so much easier to move platforms in the future.
When the GH action YAML is just invoking shell scripts, I find it quite pleasant to use
Re: Composer leaks contents of tokens configured as GitHub OAuth tokens
#10What is the security implication for private repos?