Skip to content

Commit 6f9637f

Browse files
traeoktraeok
authored
fix: credential leak in placeholder of PW prompt (#3842)
* fix: credential leak in placeholder of PW prompt Signed-off-by: Trae Yelovich <[email protected]> * remove jest runner settings from testing Signed-off-by: Trae Yelovich <[email protected]> * test: add case to prevent future regressions Signed-off-by: Trae Yelovich <[email protected]> --------- Signed-off-by: Trae Yelovich <[email protected]>
1 parent 600a73d commit 6f9637f

File tree

4 files changed

+76
-47
lines changed

4 files changed

+76
-47
lines changed

‎packages/zowe-explorer-api/__tests__/__unit__/vscode/ZoweVsCodeExtension.unit.test.ts‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -645,6 +645,35 @@ describe("ZoweVsCodeExtension", () => {
645645
};
646646
const onProfileUpdatedEmitter = new vscode.EventEmitter<imperative.IProfileLoaded>();
647647

648+
it("should not leak the password value in the input box placeholder", async () => {
649+
const mockUpdateProperty = jest.fn();
650+
jest.spyOn(ZoweVsCodeExtension, "getZoweExplorerApi").mockReturnValueOnce({
651+
onProfileUpdated: onProfileUpdatedEmitter.event,
652+
onProfileUpdatedEmitter,
653+
} as any);
654+
jest.spyOn(ZoweVsCodeExtension as any, "profilesCache", "get").mockReturnValue({
655+
getLoadedProfConfig: jest.fn().mockReturnValue({
656+
profile: {},
657+
}),
658+
getProfileInfo: jest.fn().mockReturnValue({
659+
getTeamConfig: jest.fn().mockReturnValue({ properties: { autoStore: true } }),
660+
isSecured: jest.fn().mockReturnValue(true),
661+
updateProperty: mockUpdateProperty,
662+
}),
663+
refresh: jest.fn(),
664+
updateCachedProfile: jest.fn(),
665+
});
666+
const showInputBoxSpy = jest.spyOn(Gui, "showInputBox").mockResolvedValueOnce("fakeUser").mockResolvedValueOnce("fakePassword");
667+
const profileLoaded: imperative.IProfileLoaded = await ZoweVsCodeExtension.updateCredentials(
668+
promptCredsOptions,
669+
undefined as unknown as Types.IApiRegisterClient
670+
);
671+
expect(profileLoaded.profile?.password).toBe("fakePassword");
672+
expect(showInputBoxSpy).toHaveBeenCalledTimes(2);
673+
// The placeholder should not contain the raw password value
674+
expect(showInputBoxSpy.mock.calls[1][0].placeHolder).not.toBe("fakePassword");
675+
});
676+
648677
it("should update user and password as secure fields", async () => {
649678
const mockUpdateProperty = jest.fn();
650679
jest.spyOn(ZoweVsCodeExtension, "getZoweExplorerApi").mockReturnValueOnce({

‎packages/zowe-explorer/l10n/bundle.l10n.json‎

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -243,42 +243,6 @@
243243
"Uploading USS files...": "Uploading USS files...",
244244
"Error uploading files": "Error uploading files",
245245
"Retrieving response from USS list API": "Retrieving response from USS list API",
246-
"The 'move' function is not implemented for this USS API.": "The 'move' function is not implemented for this USS API.",
247-
"Failed to move {0}/File path": {
248-
"message": "Failed to move {0}",
249-
"comment": [
250-
"File path"
251-
]
252-
},
253-
"Profile does not exist for this file.": "Profile does not exist for this file.",
254-
"Saving USS file...": "Saving USS file...",
255-
"Failed to rename {0}/File path": {
256-
"message": "Failed to rename {0}",
257-
"comment": [
258-
"File path"
259-
]
260-
},
261-
"Failed to delete {0}/File name": {
262-
"message": "Failed to delete {0}",
263-
"comment": [
264-
"File name"
265-
]
266-
},
267-
"No error details given": "No error details given",
268-
"Error fetching destination {0} for paste action: {1}/USS pathError message": {
269-
"message": "Error fetching destination {0} for paste action: {1}",
270-
"comment": [
271-
"USS path",
272-
"Error message"
273-
]
274-
},
275-
"Failed to copy {0} to {1}/Source pathDestination path": {
276-
"message": "Failed to copy {0} to {1}",
277-
"comment": [
278-
"Source path",
279-
"Destination path"
280-
]
281-
},
282246
"Downloaded: {0}/Download time": {
283247
"message": "Downloaded: {0}",
284248
"comment": [
@@ -341,6 +305,42 @@
341305
"initializeUSSFavorites.error.buttonRemove": "initializeUSSFavorites.error.buttonRemove",
342306
"File does not exist. It may have been deleted.": "File does not exist. It may have been deleted.",
343307
"Pulling from Mainframe...": "Pulling from Mainframe...",
308+
"The 'move' function is not implemented for this USS API.": "The 'move' function is not implemented for this USS API.",
309+
"Failed to move {0}/File path": {
310+
"message": "Failed to move {0}",
311+
"comment": [
312+
"File path"
313+
]
314+
},
315+
"Profile does not exist for this file.": "Profile does not exist for this file.",
316+
"Saving USS file...": "Saving USS file...",
317+
"Failed to rename {0}/File path": {
318+
"message": "Failed to rename {0}",
319+
"comment": [
320+
"File path"
321+
]
322+
},
323+
"Failed to delete {0}/File name": {
324+
"message": "Failed to delete {0}",
325+
"comment": [
326+
"File name"
327+
]
328+
},
329+
"No error details given": "No error details given",
330+
"Error fetching destination {0} for paste action: {1}/USS pathError message": {
331+
"message": "Error fetching destination {0} for paste action: {1}",
332+
"comment": [
333+
"USS path",
334+
"Error message"
335+
]
336+
},
337+
"Failed to copy {0} to {1}/Source pathDestination path": {
338+
"message": "Failed to copy {0} to {1}",
339+
"comment": [
340+
"Source path",
341+
"Destination path"
342+
]
343+
},
344344
"{0} location/Node type": {
345345
"message": "{0} location",
346346
"comment": [

‎packages/zowe-explorer/l10n/poeditor.json‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -706,15 +706,6 @@
706706
"Uploading USS files...": "",
707707
"Error uploading files": "",
708708
"Retrieving response from USS list API": "",
709-
"The 'move' function is not implemented for this USS API.": "",
710-
"Failed to move {0}": "",
711-
"Profile does not exist for this file.": "",
712-
"Saving USS file...": "",
713-
"Failed to rename {0}": "",
714-
"Failed to delete {0}": "",
715-
"No error details given": "",
716-
"Error fetching destination {0} for paste action: {1}": "",
717-
"Failed to copy {0} to {1}": "",
718709
"Downloaded: {0}": "",
719710
"Encoding: {0}": "",
720711
"Binary": "",
@@ -741,6 +732,15 @@
741732
"initializeUSSFavorites.error.buttonRemove": "",
742733
"File does not exist. It may have been deleted.": "",
743734
"Pulling from Mainframe...": "",
735+
"The 'move' function is not implemented for this USS API.": "",
736+
"Failed to move {0}": "",
737+
"Profile does not exist for this file.": "",
738+
"Saving USS file...": "",
739+
"Failed to rename {0}": "",
740+
"Failed to delete {0}": "",
741+
"No error details given": "",
742+
"Error fetching destination {0} for paste action: {1}": "",
743+
"Failed to copy {0} to {1}": "",
744744
"{0} location": "",
745745
"Choose a location to create the {0}": "",
746746
"Name of file or directory": "",

‎packages/zowe-explorer/src/configuration/Profiles.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -608,15 +608,15 @@ export class Profiles extends ProfilesCache {
608608
const isProfileString = typeof profile === "string";
609609
const profilename = isProfileString ? profile : profile.name;
610610
const userInputBoxOptions: vscode.InputBoxOptions = {
611-
placeHolder: isProfileString ? vscode.l10n.t(`User Name`) : profile.profile.user,
611+
placeHolder: vscode.l10n.t(`User Name`),
612612
prompt: vscode.l10n.t({
613613
message: "Enter the user name for the {0} connection. Leave blank to not store.",
614614
args: [profilename],
615615
comment: ["Profile name"],
616616
}),
617617
};
618618
const passwordInputBoxOptions: vscode.InputBoxOptions = {
619-
placeHolder: isProfileString ? vscode.l10n.t(`Password`) : profile.profile.password,
619+
placeHolder: vscode.l10n.t(`Password`),
620620
prompt: vscode.l10n.t({
621621
message: "Enter the password for the {0} connection. Leave blank to not store.",
622622
args: [profilename],

0 commit comments

Comments
 (0)