Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using GitHub with GITHUB_TOKEN without Prefix leaks token #1517

Closed
rowi1de opened this issue Nov 22, 2019 · 6 comments
Closed

Using GitHub with GITHUB_TOKEN without Prefix leaks token #1517

rowi1de opened this issue Nov 22, 2019 · 6 comments
Labels
Type: Support Any questions, information, or general needs around the SDK or GitHub APIs

Comments

@rowi1de
Copy link

rowi1de commented Nov 22, 2019

import * as core from '@actions/core';
import { context, GitHub } from '@actions/github'

//comes from {{secrets.GITHUB_TOKEN}}
const repoToken = core.getInput('repo-token', { required: true })
const client = new GitHub(repoToken)

will leak the token on error:

"Could not resolve to a node with the global id of 'M....c='."

19-11-22T16:44:34.9046342Z (node:2404) UnhandledPromiseRejectionWarning: HttpError: Validation Failed: "Could not resolve to a node with the global id of 'M....c='."
2019-11-22T16:44:34.9047036Z     at /home/runner/work/_actions/rowi1de/typescript-action/master/node_modules/@octokit/request/dist-node/index.js:66:23
2019-11-22T16:44:34.9047273Z     at processTicksAndRejections (internal/process/task_queues.js:89:5)
201

see actions/typescript-action#40

@gr2m
Copy link
Contributor

gr2m commented Nov 22, 2019

Hmmm can you manage to reproduce the problem with just using @octokit/rest?

I would recommend to use @octokit/action. You need to set the GITHUB_TOKEN environment variable as it's the convention, it will take care of authorization for you.

It does not have all the named methods for all the REST API endpoints yet, but you have octokit.graphql and octokit.request which is usually all that you need.

@gr2m gr2m added the Type: Support Any questions, information, or general needs around the SDK or GitHub APIs label Nov 22, 2019
@rowi1de
Copy link
Author

rowi1de commented Nov 26, 2019

I’m passing {{secrets.GITHUB_TOKEN}} as the parameter into my action.
This value is set by GitHub automatically, as documented here https://help.github.com/en/actions/automating-your-workflow-with-github-actions/authenticating-with-the-github_token#using-the-github_token-in-a-workflow

Using the action you mentioned could be an alternative. But not sure if that would make a difference

In the second example (direct rest call) they ass the bearer prefix: https://help.github.com/en/actions/automating-your-workflow-with-github-actions/authenticating-with-the-github_token#example-calling-the-rest-api

Do I need to tell the Oktokit client what kind of token it is?

@gr2m
Copy link
Contributor

gr2m commented Nov 26, 2019

I can't tell what exactly is happening, but I don't think that the problem is with @octokit/rest, but with @actions/github. I did not write the code for the latter and I don't know if it's maintained.

I've added the REST API endpoint methods to @octokit/action yesterday, so it should be simple to use that now, and it will take care of authentication for you, without the need to manually pass in a token, as long as you set the GITHUB_TOKEN environment variable.

@rowi1de
Copy link
Author

rowi1de commented Nov 27, 2019

@actions/github was provided by GitHub https://github.com/actions/toolkit/tree/master/packages/github I’ll create an issue there. actions/toolkit#233

Thanks for the support, I’ll try your implementation 👍🏻

@stale
Copy link

stale bot commented Dec 25, 2019

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale stale bot added the stale label Dec 25, 2019
@rowi1de
Copy link
Author

rowi1de commented Dec 26, 2019

actions/toolkit#233

@rowi1de rowi1de closed this as completed Dec 26, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: Support Any questions, information, or general needs around the SDK or GitHub APIs
Projects
None yet
Development

No branches or pull requests

2 participants