github/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2025-12-10 16:51:24 +01:00
Code Issues Projects Releases Packages Wiki Activity

Fix for accidentally leaking secrets in /-/metadata, closes #538

Browse source
This commit is contained in:
Simon Willison 2019-07-03 22:47:45 -07:00
commit ac0a18dbb2
2 changed files with 14 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
datasette/app.py
View file

@ -271,12 +271,15 @@ class Datasette:
plugin_config = plugins.get(plugin_name) plugin_config = plugins.get(plugin_name)
# Resolve any $file and $env keys # Resolve any $file and $env keys
if isinstance(plugin_config, dict): if isinstance(plugin_config, dict):
for key, value in plugin_config.items(): # Create a copy so we don't mutate the version visible at /-/metadata.json
plugin_config_copy = dict(plugin_config)
for key, value in plugin_config_copy.items():
if isinstance(value, dict): if isinstance(value, dict):
if list(value.keys()) == ["$env"]: if list(value.keys()) == ["$env"]:
plugin_config[key] = os.environ.get(list(value.values())[0]) plugin_config_copy[key] = os.environ.get(list(value.values())[0])
elif list(value.keys()) == ["$file"]: elif list(value.keys()) == ["$file"]:
plugin_config[key] = open(list(value.values())[0]).read() plugin_config_copy[key] = open(list(value.values())[0]).read()
return plugin_config_copy
return plugin_config return plugin_config
def app_css_hash(self): def app_css_hash(self):

8
tests/test_plugins.py
View file

@ -129,12 +129,20 @@ def test_plugin_config(app_client):
def test_plugin_config_env(app_client): def test_plugin_config_env(app_client):
os.environ["FOO_ENV"] = "FROM_ENVIRONMENT" os.environ["FOO_ENV"] = "FROM_ENVIRONMENT"
assert {"foo": "FROM_ENVIRONMENT"} == app_client.ds.plugin_config("env-plugin") assert {"foo": "FROM_ENVIRONMENT"} == app_client.ds.plugin_config("env-plugin")
# Ensure secrets aren't visible in /-/metadata.json
metadata = app_client.get("/-/metadata.json")
assert {"foo": {"$env": "FOO_ENV"}} == metadata.json["plugins"]["env-plugin"]
del os.environ["FOO_ENV"] del os.environ["FOO_ENV"]
def test_plugin_config_file(app_client): def test_plugin_config_file(app_client):
open(TEMP_PLUGIN_SECRET_FILE, "w").write("FROM_FILE") open(TEMP_PLUGIN_SECRET_FILE, "w").write("FROM_FILE")
assert {"foo": "FROM_FILE"} == app_client.ds.plugin_config("file-plugin") assert {"foo": "FROM_FILE"} == app_client.ds.plugin_config("file-plugin")
# Ensure secrets aren't visible in /-/metadata.json
metadata = app_client.get("/-/metadata.json")
assert {"foo": {"$file": TEMP_PLUGIN_SECRET_FILE}} == metadata.json["plugins"][
"file-plugin"
]
os.remove(TEMP_PLUGIN_SECRET_FILE) os.remove(TEMP_PLUGIN_SECRET_FILE)