diff options
Diffstat (limited to 'src/git-source-provider.ts')
| -rw-r--r-- | src/git-source-provider.ts | 30 |
1 files changed, 25 insertions, 5 deletions
diff --git a/src/git-source-provider.ts b/src/git-source-provider.ts index 6b7a9f7..8c7aa15 100644 --- a/src/git-source-provider.ts +++ b/src/git-source-provider.ts @@ -259,14 +259,34 @@ async function configureAuthToken( git: IGitCommandManager, authToken: string ): Promise<void> { - // Add extraheader (auth) - const base64Credentials = Buffer.from( + // Configure a placeholder value. This approach avoids the credential being captured + // by process creation audit events, which are commonly logged. For more information, + // refer to https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing + const placeholder = `AUTHORIZATION: basic ***` + await git.config(authConfigKey, placeholder) + + // Determine the basic credential value + const basicCredential = Buffer.from( `x-access-token:${authToken}`, 'utf8' ).toString('base64') - core.setSecret(base64Credentials) - const authConfigValue = `AUTHORIZATION: basic ${base64Credentials}` - await git.config(authConfigKey, authConfigValue) + core.setSecret(basicCredential) + + // Replace the value in the config file + const configPath = path.join(git.getWorkingDirectory(), '.git', 'config') + let content = (await fs.promises.readFile(configPath)).toString() + const placeholderIndex = content.indexOf(placeholder) + if ( + placeholderIndex < 0 || + placeholderIndex != content.lastIndexOf(placeholder) + ) { + throw new Error('Unable to replace auth placeholder in .git/config') + } + content = content.replace( + placeholder, + `AUTHORIZATION: basic ${basicCredential}` + ) + await fs.promises.writeFile(configPath, content) } async function removeGitConfig( |