Fine-grained access-tokens #12465
Fine-grained access-tokens #12465
Conversation
github-actions
bot
added
the
fetching
| { | ||
| auto tokens = settings.accessTokens.get(); | ||
| std::string answer; |
There was a problem hiding this comment.
This needs a comment explaining that it searches for the longest possible match.
| if(! url.empty()) { | ||
| for (auto & token : tokens) { | ||
| auto match_len = url.find(token.first); | ||
| if (match_len != std::string::npos && token.first.length() > answer_match_len) { |
There was a problem hiding this comment.
This will make the URL github.com/foobar match against the token for github.com/foo and I'm not sure that's desirable. Maybe it should only match if the match is followed by a / or end-of-string. (Similar to isInDir().)
There was a problem hiding this comment.
And in general the substring search is a bit iffy, since the token github.com/foo will also match attacker.org/github.com/foo which could theoretically be used to exfiltrate an access token? (If the attacker can get a user to evaluate an expression containing that URL, for instance.)
Maybe it should parse the URL and match the authority and path fields separately.
Motivation
Support fine-grained tokens, multiple tokens per host.
Context
Supports:
Fixes: #8474