Stop credential tokens leaking into usage output

Token flags registered their env value as the pflag default (e.g. StringVar(&auth.Token, "source-token", envOr("GITSYNC_SOURCE_TOKEN", ""))). pflag prints non-empty defaults in --help, and the unknown-flag fallback in main.go dumps the full usage block to stderr — so a typo'd flag in a CI job with GITSYNC_***_TOKEN set wrote the credential into CI logs.

Register secret flags (source/target token + bearer-token, including the inlined ones in convert-sha256) with empty defaults and apply the env value after parsing via a PreRunE hook, only when the flag was not given explicitly. An explicit flag still wins over the environment.

Add chainPreRunE so independent flag helpers can each attach post-parse logic without clobbering one another, and route allRefsFlag through it too.

Sessions

Changes

3

• cmd/git-sync

• Mconvert_sha256.go+4/-2

• Mflags.go+40/-8

• Aflags_test.go+58

74 unmodified lines

envBool("GITSYNC_SOURCE_FOLLOW_INFO_REFS_REDIRECT"), "send follow-up source RPCs to the final /info/refs redirect host") cmd.Flags().StringVar(&req.SourceAuth.Token, "source-token", envOr("GITSYNC_SOURCE_TOKEN", ""), "source token/password") "", "source token/password (env: GITSYNC_SOURCE_TOKEN)") cmd.Flags().StringVar(&req.SourceAuth.Username, "source-username", envOr("GITSYNC_SOURCE_USERNAME", "git"), "source basic auth username") cmd.Flags().StringVar(&req.SourceAuth.BearerToken, "source-bearer-token", envOr("GITSYNC_SOURCE_BEARER_TOKEN", ""), "source bearer token") "", "source bearer token (env: GITSYNC_SOURCE_BEARER_TOKEN)") addSecretEnvFallback(cmd, "source-token", &req.SourceAuth.Token, "GITSYNC_SOURCE_TOKEN") addSecretEnvFallback(cmd, "source-bearer-token", &req.SourceAuth.BearerToken, "GITSYNC_SOURCE_BEARER_TOKEN") cmd.Flags().BoolVar(&req.SourceAuth.SkipTLSVerify, "source-insecure-skip-tls-verify", envBool("GITSYNC_SOURCE_INSECURE_SKIP_TLS_VERIFY"), "skip TLS certificate verification for the source")

Mcmd/git-sync/convert_sha256.go+4/-2

24 unmodified lines

func addSourceAuth(cmd *cobra.Command, auth *gitsync.EndpointAuth) {
    cmd.Flags().StringVar(&auth.Token, "source-token", envOr("GITSYNC_SOURCE_TOKEN", ""), "source token/password")
    cmd.Flags().StringVar(&auth.Token, "source-token", "", "source token/password (env: GITSYNC_SOURCE_TOKEN)")
    cmd.Flags().StringVar(&auth.Username, "source-username", envOr("GITSYNC_SOURCE_USERNAME", "git"), "source basic auth username")
    cmd.Flags().StringVar(&auth.BearerToken, "source-bearer-token", envOr("GITSYNC_SOURCE_BEARER_TOKEN", ""), "source bearer token")
    cmd.Flags().StringVar(&auth.BearerToken, "source-bearer-token", "", "source bearer token (env: GITSYNC_SOURCE_BEARER_TOKEN)")
    cmd.Flags().BoolVar(&auth.SkipTLSVerify, "source-insecure-skip-tls-verify",
        envBool("GITSYNC_SOURCE_INSECURE_SKIP_TLS_VERIFY"),
        "skip TLS certificate verification for the source")
    addSecretEnvFallback(cmd, "source-token", &auth.Token, "GITSYNC_SOURCE_TOKEN")
    addSecretEnvFallback(cmd, "source-bearer-token", &auth.BearerToken, "GITSYNC_SOURCE_BEARER_TOKEN")
}

func addTargetAuth(cmd *cobra.Command, auth *gitsync.EndpointAuth) {
    cmd.Flags().StringVar(&auth.Token, "target-token", envOr("GITSYNC_TARGET_TOKEN", ""), "target token/password")
    cmd.Flags().StringVar(&auth.Token, "target-token", "", "target token/password (env: GITSYNC_TARGET_TOKEN)")
    cmd.Flags().StringVar(&auth.Username, "target-username", envOr("GITSYNC_TARGET_USERNAME", "git"), "target basic auth username")
    cmd.Flags().StringVar(&auth.BearerToken, "target-bearer-token", envOr("GITSYNC_TARGET_BEARER_TOKEN", ""), "target bearer token")
    cmd.Flags().StringVar(&auth.BearerToken, "target-bearer-token", "", "target bearer token (env: GITSYNC_TARGET_BEARER_TOKEN)")
    cmd.Flags().BoolVar(&auth.SkipTLSVerify, "target-insecure-skip-tls-verify",
        envBool("GITSYNC_TARGET_INSECURE_SKIP_TLS_VERIFY"),
        "skip TLS certificate verification for the target")
    addSecretEnvFallback(cmd, "target-token", &auth.Token, "GITSYNC_TARGET_TOKEN")
    addSecretEnvFallback(cmd, "target-bearer-token", &auth.BearerToken, "GITSYNC_TARGET_BEARER_TOKEN")
}

func addProtocolFlag(cmd *cobra.Command, mode *protocolModeFlag) {
26 unmodified lines

if len(implies) == 0 {
        return
    }
    prev := cmd.PreRunE
    cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
    chainPreRunE(cmd, func(*cobra.Command, []string) error {
        if *allRefs {
            for _, p := range implies {
                if p != nil {
1 unmodified line

}
            }
        }
        return nil
        }
    })
}

// chainPreRunE appends fn to cmd's PreRunE, preserving any hook already
// registered (which runs first). Lets independent flag helpers each attach
// post-parse logic to the same command without clobbering one another.
func chainPreRunE(cmd *cobra.Command, fn func(*cobra.Command, []string) error) {
    prev := cmd.PreRunE
    cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
        if prev != nil {
            return prev(cmd, args)
            if err := prev(cmd, args); err != nil {
                return err
            }
        }
        return nil
        return fn(cmd, args)
    }
}

// addSecretEnvFallback fills *dst from the named environment variable after
// parsing, but only when the flag was not given explicitly. Secret-bearing
// flags must register an empty pflag default rather than the env value:
// pflag prints non-empty defaults in --help and in the usage block dumped on
// a flag error, which would leak the secret (e.g. into CI logs).
func addSecretEnvFallback(cmd *cobra.Command, flag string, dst *string, env string) {
    chainPreRunE(cmd, func(cmd *cobra.Command, _ []string) error {
        if cmd.Flags().Changed(flag) {
            return nil
        }
        if v := os.Getenv(env); v != "" {
            *dst = v
        }
        return nil
    })
}

func newProtocolFlag() protocolModeFlag {
    return protocolModeFlag(protocolMode(envOr("GITSYNC_PROTOCOL", validation.ProtocolAuto)))
}