From 54889ca1092e387418f917bcf520ef23d415e8a0 Mon Sep 17 00:00:00 2001 From: Jordi Boggiano Date: Tue, 9 Mar 2021 21:37:43 +0100 Subject: [PATCH] Document GH token usage and also make sure we redact them in Process debug output, refs #9757 --- src/Composer/IO/BaseIO.php | 2 ++ src/Composer/Util/ProcessExecutor.php | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/Composer/IO/BaseIO.php b/src/Composer/IO/BaseIO.php index ec914f5f8..013597450 100644 --- a/src/Composer/IO/BaseIO.php +++ b/src/Composer/IO/BaseIO.php @@ -125,6 +125,8 @@ abstract class BaseIO implements IOInterface, LoggerInterface } foreach ($githubOauth as $domain => $token) { + // allowed chars for GH tokens are from https://github.blog/changelog/2021-03-04-authentication-token-format-updates/ + // plus dots which were at some point used for GH app integration tokens if (!preg_match('{^[.A-Za-z0-9_]+$}', $token)) { throw new \UnexpectedValueException('Your github oauth token for '.$domain.' contains invalid characters: "'.$token.'"'); } diff --git a/src/Composer/Util/ProcessExecutor.php b/src/Composer/Util/ProcessExecutor.php index cb935e0eb..cb1886e94 100644 --- a/src/Composer/Util/ProcessExecutor.php +++ b/src/Composer/Util/ProcessExecutor.php @@ -45,7 +45,8 @@ class ProcessExecutor { if ($this->io && $this->io->isDebug()) { $safeCommand = preg_replace_callback('{://(?P[^:/\s]+):(?P[^@\s/]+)@}i', function ($m) { - if (preg_match('{^[a-f0-9]{12,}$}', $m['user'])) { + // if the username looks like a long (12char+) hex string, or a modern github token (e.g. gp1_xxx) we obfuscate that + if (preg_match('{^([a-f0-9]{12,}|g[a-z]\d_[a-zA-Z0-9_]+)$}', $m['user'])) { return '://***:***@'; }