Skip to content

Conversation

@lukekarrys
Copy link
Contributor

Fixes #3867

@lukekarrys lukekarrys requested a review from a team as a code owner May 13, 2024 22:41
@npm-cli-bot
Copy link
Collaborator

npm-cli-bot commented May 13, 2024

no statistically significant performance changes detected

timing results
app-large clean lock-only cache-only modules-only no-lock no-cache no-modules no-clean show-version run-script cache-only
peer-deps
no-clean
audit
npm@latest 33.889 ±1.16 10.629 ±0.03 11.739 ±0.03 1.555 ±0.00 1.549 ±0.00 1.285 ±0.01 8.234 ±0.00 1.296 ±0.01 0.139 ±0.00 0.167 ±0.00 13.357 ±0.19 3.519 ±2.06
#7521 32.651 ±0.92 10.619 ±0.00 11.680 ±0.02 1.561 ±0.05 1.544 ±0.02 1.270 ±0.01 8.248 ±0.05 1.291 ±0.02 0.137 ±0.00 0.164 ±0.00 14.672 ±0.02 2.164 ±0.09
app-medium clean lock-only cache-only modules-only no-lock no-cache no-modules no-clean show-version run-script cache-only
peer-deps
no-clean
audit
npm@latest 26.959 ±1.76 7.944 ±0.02 8.856 ±0.03 1.519 ±0.01 1.515 ±0.00 1.413 ±0.01 5.796 ±0.01 1.318 ±0.01 0.139 ±0.00 0.165 ±0.00 9.528 ±0.17 3.052 ±1.55
#7521 25.791 ±1.42 7.956 ±0.03 8.819 ±0.02 1.509 ±0.01 1.497 ±0.01 1.408 ±0.00 5.839 ±0.03 1.313 ±0.01 0.139 ±0.00 0.166 ±0.00 9.822 ±0.05 1.986 ±0.08

@wraithgar
Copy link
Member

I think if we're gonna redact we redact. We should acknowledge that there are some values that aren't worth showing at all (and they are currently accounted for) but some that may contain urls with passwords. Proxy and registry come to mind. If we simply pass all of the displayed values through redact (now that we are using it) this would help

@lukekarrys
Copy link
Contributor Author

+1 for treating registry however we end up treating proxy

@lukekarrys lukekarrys changed the title fix(config): protect proxy if it contains basic auth fix(config): protect url fields if they contain basic auth May 14, 2024
@lukekarrys lukekarrys changed the title fix(config): protect url fields if they contain basic auth fix(config): use redact on config output May 14, 2024
@lukekarrys lukekarrys merged commit badeac2 into latest May 14, 2024
@lukekarrys lukekarrys deleted the lk/protect-proxy branch May 14, 2024 20:49
@github-actions github-actions bot mentioned this pull request May 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] Password in plain text when getting the proxy details from config through CLI

3 participants