From: Emily Shaffer <emilyshaffer@google.com>
To: git@vger.kernel.org
Cc: Emily Shaffer <emilyshaffer@google.com>
Subject: [PATCH v2 2/2] bugreport: generate config whitelist based on docs
Date: Fri, 16 Aug 2019 17:39:26 -0700 [thread overview]
Message-ID: <20190817003926.102944-3-emilyshaffer@google.com> (raw)
In-Reply-To: <20190817003926.102944-1-emilyshaffer@google.com>
Add a new step to the build to generate a whitelist of git-config
variables which are appropriate to include in the output of
git-bugreport. New variables can be added to the whitelist by annotating
their documentation in Documentation/config with the line
"// bugreport-include".
Some configs are private in nature, and can contain remote URLs,
passwords, or other sensitive information. In the event that a user
doesn't notice their information while reviewing a bugreport, that user
may leak their credentials to other individuals, mailing lists, or bug
tracking tools inadvertently. Heuristic blacklisting of configuration
keys is imperfect and prone to false negatives; given the nature of the
information which can be leaked, a whitelist is more reliable.
In order to prevent staleness of the whitelist, add a mechanism to
generate the whitelist from annotations in the config documentation,
where contributors are already used to documenting their new config
keys.
Additionally, add annotations to the sendemail config documentation in
order to demonstrate a proof of concept.
Signed-off-by: Emily Shaffer <emilyshaffer@google.com>
---
.gitignore | 1 +
Documentation/config/sendemail.txt | 68 +++++++++++++-------------
Makefile | 9 +++-
bugreport-generate-config-whitelist.sh | 4 ++
git-bugreport-config-whitelist | 22 ---------
5 files changed, 47 insertions(+), 57 deletions(-)
create mode 100755 bugreport-generate-config-whitelist.sh
delete mode 100644 git-bugreport-config-whitelist
diff --git a/.gitignore b/.gitignore
index b4f5433084..65cc74c748 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,6 +26,7 @@
/git-blame
/git-branch
/git-bugreport
+/git-bugreport-config-whitelist
/git-bundle
/git-cat-file
/git-check-attr
diff --git a/Documentation/config/sendemail.txt b/Documentation/config/sendemail.txt
index 0006faf800..69f3e4f219 100644
--- a/Documentation/config/sendemail.txt
+++ b/Documentation/config/sendemail.txt
@@ -1,63 +1,63 @@
-sendemail.identity::
+sendemail.identity:: // bugreport-exclude
A configuration identity. When given, causes values in the
'sendemail.<identity>' subsection to take precedence over
values in the 'sendemail' section. The default identity is
the value of `sendemail.identity`.
-sendemail.smtpEncryption::
+sendemail.smtpEncryption:: // bugreport-include
See linkgit:git-send-email[1] for description. Note that this
setting is not subject to the 'identity' mechanism.
-sendemail.smtpssl (deprecated)::
+sendemail.smtpssl (deprecated):: // bugreport-exclude
Deprecated alias for 'sendemail.smtpEncryption = ssl'.
-sendemail.smtpsslcertpath::
+sendemail.smtpsslcertpath:: // bugreport-exclude
Path to ca-certificates (either a directory or a single file).
Set it to an empty string to disable certificate verification.
-sendemail.<identity>.*::
+sendemail.<identity>.*:: // bugreport-exclude
Identity-specific versions of the 'sendemail.*' parameters
found below, taking precedence over those when this
identity is selected, through either the command-line or
`sendemail.identity`.
-sendemail.aliasesFile::
-sendemail.aliasFileType::
-sendemail.annotate::
-sendemail.bcc::
-sendemail.cc::
-sendemail.ccCmd::
-sendemail.chainReplyTo::
-sendemail.confirm::
-sendemail.envelopeSender::
-sendemail.from::
-sendemail.multiEdit::
-sendemail.signedoffbycc::
-sendemail.smtpPass::
-sendemail.suppresscc::
-sendemail.suppressFrom::
-sendemail.to::
-sendemail.tocmd::
-sendemail.smtpDomain::
-sendemail.smtpServer::
-sendemail.smtpServerPort::
-sendemail.smtpServerOption::
-sendemail.smtpUser::
-sendemail.thread::
-sendemail.transferEncoding::
-sendemail.validate::
-sendemail.xmailer::
+sendemail.aliasesFile:: // bugreport-exclude
+sendemail.aliasFileType:: // bugreport-exclude
+sendemail.annotate:: // bugreport-include
+sendemail.bcc:: // bugreport-include
+sendemail.cc:: // bugreport-include
+sendemail.ccCmd:: // bugreport-include
+sendemail.chainReplyTo:: // bugreport-include
+sendemail.confirm:: // bugreport-include
+sendemail.envelopeSender:: // bugreport-include
+sendemail.from:: // bugreport-include
+sendemail.multiEdit:: // bugreport-include
+sendemail.signedoffbycc:: // bugreport-include
+sendemail.smtpPass:: // bugreport-exclude
+sendemail.suppresscc:: // bugreport-include
+sendemail.suppressFrom:: // bugreport-include
+sendemail.to:: // bugreport-include
+sendemail.tocmd:: // bugreport-include
+sendemail.smtpDomain:: // bugreport-include
+sendemail.smtpServer:: // bugreport-include
+sendemail.smtpServerPort:: // bugreport-include
+sendemail.smtpServerOption:: // bugreport-include
+sendemail.smtpUser:: // bugreport-exclude
+sendemail.thread:: // bugreport-include
+sendemail.transferEncoding:: // bugreport-include
+sendemail.validate:: // bugreport-include
+sendemail.xmailer:: // bugreport-include
See linkgit:git-send-email[1] for description.
-sendemail.signedoffcc (deprecated)::
+sendemail.signedoffcc (deprecated):: // bugreport-exclude
Deprecated alias for `sendemail.signedoffbycc`.
-sendemail.smtpBatchSize::
+sendemail.smtpBatchSize:: // bugreport-include
Number of messages to be sent per connection, after that a relogin
will happen. If the value is 0 or undefined, send all messages in
one connection.
See also the `--batch-size` option of linkgit:git-send-email[1].
-sendemail.smtpReloginDelay::
+sendemail.smtpReloginDelay:: // bugreport-include
Seconds wait before reconnecting to smtp server.
See also the `--relogin-delay` option of linkgit:git-send-email[1].
diff --git a/Makefile b/Makefile
index 69801a1c45..a62bbefb8f 100644
--- a/Makefile
+++ b/Makefile
@@ -639,6 +639,10 @@ SCRIPT_PYTHON += git-p4.py
SCRIPT_SH_GEN = $(patsubst %.sh,%,$(SCRIPT_SH))
SCRIPT_PERL_GEN = $(patsubst %.perl,%,$(SCRIPT_PERL))
SCRIPT_PYTHON_GEN = $(patsubst %.py,%,$(SCRIPT_PYTHON))
+SCRIPT_DEPENDENCIES = git-bugreport-config-whitelist
+
+$(SCRIPT_DEPENDENCIES): Documentation/config/*.txt
+ sh bugreport-generate-config-whitelist.sh
# Individual rules to allow e.g.
# "make -C ../.. SCRIPT_PERL=contrib/foo/bar.perl build-perl-script"
@@ -656,17 +660,20 @@ install-perl-script: $(SCRIPT_PERL_GEN)
install-python-script: $(SCRIPT_PYTHON_GEN)
$(INSTALL) $^ '$(DESTDIR_SQ)$(gitexec_instdir_SQ)'
-.PHONY: clean-perl-script clean-sh-script clean-python-script
+.PHONY: clean-perl-script clean-sh-script clean-python-script clean-script-dependencies
clean-sh-script:
$(RM) $(SCRIPT_SH_GEN)
clean-perl-script:
$(RM) $(SCRIPT_PERL_GEN)
clean-python-script:
$(RM) $(SCRIPT_PYTHON_GEN)
+clean-script-dependencies:
+ $(RM) $(SCRIPT_DEPENDENCIES)
SCRIPTS = $(SCRIPT_SH_GEN) \
$(SCRIPT_PERL_GEN) \
$(SCRIPT_PYTHON_GEN) \
+ $(SCRIPT_DEPENDENCIES) \
git-instaweb
ETAGS_TARGET = TAGS
diff --git a/bugreport-generate-config-whitelist.sh b/bugreport-generate-config-whitelist.sh
new file mode 100755
index 0000000000..ca6b232024
--- /dev/null
+++ b/bugreport-generate-config-whitelist.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+grep -RhPo ".*(?=:: \/\/ bugreport-include)" Documentation/config \
+ >git-bugreport-config-whitelist
diff --git a/git-bugreport-config-whitelist b/git-bugreport-config-whitelist
deleted file mode 100644
index e4f07f7175..0000000000
--- a/git-bugreport-config-whitelist
+++ /dev/null
@@ -1,22 +0,0 @@
-http.version
-protocol.version
-protocol.persistent-https.allow
-protocol.rpc.allow
-protocol.sso.allow
-submodule.repolike
-trace2.eventtarget
-trace2.configparams
-color.ui
-core.pager
-sendemail.smtpencryption
-sendemail.smtpserver
-sendemail.smtpserverport
-sendemail.smtpsslcertpath
-credential.helper
-merge.tool
-grep.linenumber
-rerere.enabled
-core.repositoryformatversion
-core.filemode
-core.bare
-core.logallrefupdates
--
2.23.0.rc1.153.gdeed80330f-goog
next prev parent reply other threads:[~2019-08-17 0:39 UTC|newest]
Thread overview: 68+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-15 2:34 [PATCH] bugreport: add tool to generate debugging info Emily Shaffer
2019-08-15 14:15 ` Derrick Stolee
2019-08-15 14:36 ` Junio C Hamano
2019-08-15 22:52 ` Emily Shaffer
2019-08-15 23:40 ` Junio C Hamano
2019-08-16 1:25 ` Emily Shaffer
2019-08-16 16:41 ` Junio C Hamano
2019-08-16 19:08 ` Emily Shaffer
2019-08-15 20:07 ` Johannes Schindelin
2019-08-15 22:24 ` Emily Shaffer
2019-08-16 20:19 ` Johannes Schindelin
2019-08-15 20:13 ` Emily Shaffer
2019-08-15 18:10 ` Junio C Hamano
2019-08-15 21:52 ` Emily Shaffer
2019-08-15 22:29 ` Junio C Hamano
2019-08-15 22:54 ` Emily Shaffer
2019-08-17 0:39 ` [PATCH v2 0/2] add git-bugreport tool Emily Shaffer
2019-08-17 0:39 ` [PATCH v2 1/2] bugreport: add tool to generate debugging info Emily Shaffer
2019-08-17 0:39 ` Emily Shaffer [this message]
2019-08-17 20:38 ` [PATCH v2 2/2] bugreport: generate config whitelist based on docs Martin Ågren
2019-08-21 17:40 ` Emily Shaffer
2019-10-25 2:51 ` [PATCH v3 0/9] add git-bugreport tool Emily Shaffer
2019-10-25 2:51 ` [PATCH v3 1/9] bugreport: add tool to generate debugging info Emily Shaffer
2019-10-29 20:29 ` Josh Steadmon
2019-11-16 3:11 ` Junio C Hamano
2019-11-19 20:25 ` Emily Shaffer
2019-11-19 23:24 ` Johannes Schindelin
2019-11-20 0:37 ` Junio C Hamano
2019-11-20 10:51 ` Johannes Schindelin
2019-11-19 23:31 ` Johannes Schindelin
2019-11-20 0:39 ` Junio C Hamano
2019-11-20 2:09 ` Emily Shaffer
2019-11-20 0:32 ` Junio C Hamano
2019-10-25 2:51 ` [PATCH v3 2/9] bugreport: generate config whitelist based on docs Emily Shaffer
2019-10-28 13:27 ` Johannes Schindelin
2019-10-25 2:51 ` [PATCH v3 3/9] bugreport: add version and system information Emily Shaffer
2019-10-28 13:49 ` Johannes Schindelin
2019-11-08 21:48 ` Emily Shaffer
2019-11-11 13:48 ` Johannes Schindelin
2019-11-14 21:42 ` Emily Shaffer
2019-10-29 20:43 ` Josh Steadmon
2019-10-25 2:51 ` [PATCH v3 4/9] bugreport: add config values from whitelist Emily Shaffer
2019-10-28 14:14 ` Johannes Schindelin
2019-12-11 20:48 ` Emily Shaffer
2019-12-15 17:30 ` Johannes Schindelin
2019-10-29 20:58 ` Josh Steadmon
2019-10-30 1:37 ` Junio C Hamano
2019-11-14 21:55 ` Emily Shaffer
2019-10-25 2:51 ` [PATCH v3 5/9] bugreport: collect list of populated hooks Emily Shaffer
2019-10-28 14:31 ` Johannes Schindelin
2019-12-11 20:51 ` Emily Shaffer
2019-12-15 17:40 ` Johannes Schindelin
2019-10-25 2:51 ` [PATCH v3 6/9] bugreport: count loose objects Emily Shaffer
2019-10-28 15:07 ` Johannes Schindelin
2019-12-10 22:34 ` Emily Shaffer
2019-10-29 21:18 ` Josh Steadmon
2019-10-25 2:51 ` [PATCH v3 7/9] bugreport: add packed object summary Emily Shaffer
2019-10-28 15:43 ` Johannes Schindelin
2019-12-11 0:29 ` Emily Shaffer
2019-12-11 13:37 ` Johannes Schindelin
2019-12-11 20:52 ` Emily Shaffer
2019-10-25 2:51 ` [PATCH v3 8/9] bugreport: list contents of $OBJDIR/info Emily Shaffer
2019-10-28 15:51 ` Johannes Schindelin
2019-10-25 2:51 ` [PATCH v3 9/9] bugreport: print contents of alternates file Emily Shaffer
2019-10-28 15:57 ` Johannes Schindelin
2019-11-19 20:40 ` Emily Shaffer
2019-10-29 1:54 ` [PATCH v3 0/9] add git-bugreport tool Junio C Hamano
2019-10-29 11:13 ` Johannes Schindelin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190817003926.102944-3-emilyshaffer@google.com \
--to=emilyshaffer@google.com \
--cc=git@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).