4 ms·
That argument to UberClient() looks like an API token. Did you mean to leave it in there for the world to use? https://github.com/jaebradley/uber-cli/blob/mast
by mritun 10y ago
That argument to UberClient() looks like an API token. Did you mean to leave it in there for the world to use?
https://github.com/jaebradley/uber-cli/blob/master/src/services/UberService.js#L14 https://github.com/jaebradley/uber-cli/blob/master/src/servi...
- zoodle 10y agoNot sure this was submitted by the original author. I forwarded a note to the repo owner pointing back here.
- jaebradley 10y agoHey, I'm the author (thanks @zoodle for notifying me). Obviously, this is a security issue that is pretty much bottom-of-the-barrel-shitty. My explanation is that I didn't feel like standing up a middleware service to direct traffic through in order to obfuscate the server token. Especially for a tool that I anticipated being used by pretty much only me. Not a satisfying answer, but thanks for exposing this security flaw - definitely going to add it to my project task queue.
- stuartd 10y agoSee also src/services/GeocodeService.js
- marblar 10y agoThere's no need for a middleware service. Just store it outside of the repo.
- jaebradley 10y agoIt's an NPM package that people download - how would you store it outside the repo such that people that download the package can reference the token? Can't really use an environment variable at that point, right? There probably has to be some HTTP request to some service that ends up forwarding the request to Uber with the token. Maybe I'm over-thinking this...
- lexpar 10y agoI think the idea is that you implement some interface for interested users to supply their own API keys.
- Chloro 10y agoYep!
- jaebradley 10y agoGotcha - ok, that certainly makes sense. Though makes for a slightly less friendly (but certainly more secure) service.
- mr_turtle 10y agoA friend of mine accidentally pushed his Heroku or New Relic API key to a toy repo which was public and that information was immediately scraped and used. He was billed a non trivial about which he disputed but cost some time and headache. Enforce best practices and don't do that even if it's for something trivial and won't have real world consequences.
- elgenie 10y ago$ uber time '123 anywhere st' No API key found. Please create one using the instructions at <site> and call 'uber set-key <key>' $ uber set-key <key> # writes <key> to a file in home dir or a .gitignore location in the repo Well done! $ uber time '123 anywhere st' # reads <key> from file, works as you have it ...
- dzhiurgis 10y agoHow does Google Maps get this information? They probably have their middleware, right?
- kfrzcode 10y agoSo if I clone this repo I can now access your API account? Might want to pull this repository from Github......