goharbor / goharbor/go-client

Security issue with credential file

Open
#32 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
52
Forks
34
PR merge metrics
No merged PRs in 30d

Description

The credential file has security issues, it can be read by group and others. This is critical since the the password is stored in clear.

-rw-r--r--@ 1 user group 208 Dec 21 10:54 /Users/user/.config/harbor-cli/config.yaml

is should be:

-rw-------@ 1 user group 208 Dec 21 10:54 /Users/user/.config/harbor-cli/config.yaml

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Inspect the code path that creates or writes ~/.config/harbor-cli/config.yaml, then reproduce the reported permissions using the example path and mode. Done means newly written credential files are restricted to the owner, with a regression check for the resulting permissions if the repository has a relevant test entry point.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.