spacebar/kamal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Shellescape command input

Browse Source
This commit is contained in:
Donal McBreen
2024-09-05 08:37:50 +01:00
parent 1522d94ac9
commit 9b96ef2412
3 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lib/kamal/secrets/adapters/bitwarden.rb
View File

@@ -4,7 +4,7 @@ class Kamal::Secrets::Adapters::Bitwarden < Kamal::Secrets::Adapters::Base
status = run_command("status") status = run_command("status")
if status["status"] == "unauthenticated" if status["status"] == "unauthenticated"
run_command("login #{account}") run_command("login #{account.shellescape}", raw: true)
status = run_command("status") status = run_command("status")
end end
@@ -24,7 +24,7 @@ class Kamal::Secrets::Adapters::Bitwarden < Kamal::Secrets::Adapters::Base
def fetch_from_vault(secrets, account:, session:) def fetch_from_vault(secrets, account:, session:)
{}.tap do |results| {}.tap do |results|
items_fields(secrets).each do |item, fields| items_fields(secrets).each do |item, fields|
item_json = run_command("get item #{item}", session: session, raw: true) item_json = run_command("get item #{item.shellescape}", session: session, raw: true)
raise RuntimeError, "Could not read #{secret} from Bitwarden" unless $?.success? raise RuntimeError, "Could not read #{secret} from Bitwarden" unless $?.success?
item_json = JSON.parse(item_json) item_json = JSON.parse(item_json)
@@ -57,7 +57,7 @@ class Kamal::Secrets::Adapters::Bitwarden < Kamal::Secrets::Adapters::Base
end end
def run_command(command, session: nil, raw: false) def run_command(command, session: nil, raw: false)
full_command = [ *("BW_SESSION=#{session}" if session), "bw", command ].join(" ") full_command = [ *("BW_SESSION=#{session.shellescape}" if session), "bw", command ].join(" ")
result = `#{full_command}`.strip result = `#{full_command}`.strip
raw ? result : JSON.parse(result) raw ? result : JSON.parse(result)
end end

4
lib/kamal/secrets/adapters/last_pass.rb
View File

@@ -2,7 +2,7 @@ class Kamal::Secrets::Adapters::LastPass < Kamal::Secrets::Adapters::Base
private private
def login(account) def login(account)
unless loggedin?(account) unless loggedin?(account)
`lpass login #{account}` `lpass login #{account.shellescape}`
raise RuntimeError, "Failed to login to 1Password" unless $?.success? raise RuntimeError, "Failed to login to 1Password" unless $?.success?
end end
end end
@@ -12,7 +12,7 @@ class Kamal::Secrets::Adapters::LastPass < Kamal::Secrets::Adapters::Base
end end
def fetch_from_vault(secrets, account:, session:) def fetch_from_vault(secrets, account:, session:)
items = `lpass show #{secrets.join(" ")} --json` items = `lpass show #{secrets.map(&:shellescape).join(" ")} --json`
raise RuntimeError, "Could not read #{secrets} from 1Password" unless $?.success? raise RuntimeError, "Could not read #{secrets} from 1Password" unless $?.success?
items = JSON.parse(items) items = JSON.parse(items)

4
lib/kamal/secrets/adapters/one_password.rb
View File

@@ -11,7 +11,7 @@ class Kamal::Secrets::Adapters::OnePassword < Kamal::Secrets::Adapters::Base
end end
def loggedin?(account) def loggedin?(account)
`op account get --account #{account}` `op account get --account #{account.shellescape}`
$?.success? $?.success?
end end
@@ -54,7 +54,7 @@ class Kamal::Secrets::Adapters::OnePassword < Kamal::Secrets::Adapters::Base
labels = fields.map { |field| "label=#{field}" }.join(",") labels = fields.map { |field| "label=#{field}" }.join(",")
options = to_options(vault: vault, fields: labels, format: "json", account: account, session: session.presence) options = to_options(vault: vault, fields: labels, format: "json", account: account, session: session.presence)
`op item get #{item} #{options}`.tap do `op item get #{item.shellescape} #{options}`.tap do
raise RuntimeError, "Could not read #{fields.join(", ")} from #{item} in the #{vault} 1Password vault" unless $?.success? raise RuntimeError, "Could not read #{fields.join(", ")} from #{item} in the #{vault} 1Password vault" unless $?.success?
end end
end end