From 574a04fa555b46e195fc97393bbb48e46883b3f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Blondon?= Date: Sat, 24 Apr 2021 21:27:10 +0200 Subject: [PATCH 1/4] Add a warning if credentials are written in lock file --- src/poetry/packages/locker.py | 6 +++++ tests/helpers.py | 1 + tests/installation/test_installer.py | 1 + tests/packages/test_locker.py | 35 +++++++++++++++++++++++++++- 4 files changed, 42 insertions(+), 1 deletion(-) diff --git a/src/poetry/packages/locker.py b/src/poetry/packages/locker.py index a0cbfb24f51..f9daaf1fb66 100644 --- a/src/poetry/packages/locker.py +++ b/src/poetry/packages/locker.py @@ -58,6 +58,7 @@ def __init__(self, lock: Path, local_config: dict[str, Any]) -> None: self._local_config = local_config self._lock_data: dict[str, Any] | None = None self._content_hash = self._get_content_hash() + self.contains_credential = False @property def lock(self) -> Path: @@ -285,6 +286,10 @@ def _should_write(self, lock: TOMLDocument) -> bool: return do_write def _write_lock_data(self, data: TOMLDocument) -> None: + if self.contains_credential: + logger.warning( + "Credential was provided in packages list. It's included in the lock file." + ) lockfile = TOMLFile(self.lock) lockfile.write(data) @@ -455,6 +460,7 @@ def _dump_package(self, package: Package) -> dict[str, Any]: if package.source_url: url = package.source_url + self.contains_credential |= bool(re.match("[a-z]+://.*:.*@.*", url)) if package.source_type in ["file", "directory"]: # The lock file should only store paths relative to the root project url = Path( diff --git a/tests/helpers.py b/tests/helpers.py index eefe9c74c1a..97451f333ca 100644 --- a/tests/helpers.py +++ b/tests/helpers.py @@ -190,6 +190,7 @@ def __init__(self, lock: Path, local_config: dict[str, Any]) -> None: super().__init__(lock, local_config) self._locked = False self._write = False + self.contains_credential = False def write(self, write: bool = True) -> None: self._write = write diff --git a/tests/installation/test_installer.py b/tests/installation/test_installer.py index d3017464754..27232379d43 100644 --- a/tests/installation/test_installer.py +++ b/tests/installation/test_installer.py @@ -102,6 +102,7 @@ def __init__(self, lock_path: Path) -> None: self._locked = False self._lock_data = None self._content_hash = self._get_content_hash() + self.contains_credential = False @property def written_data(self) -> dict[str, Any]: diff --git a/tests/packages/test_locker.py b/tests/packages/test_locker.py index 715ba5efb33..e6d13560b6b 100644 --- a/tests/packages/test_locker.py +++ b/tests/packages/test_locker.py @@ -1054,12 +1054,13 @@ def test_locked_repository_uses_root_dir_of_package( ], ) def test_content_hash_with_legacy_is_compatible( - local_config: dict[str, list[str]], fresh: bool, locker: Locker + local_config: dict[str, list[str]], fresh: bool, locker: Locker, caplog: LogCaptureFixture ) -> None: # old hash generation relevant_content = {} for key in locker._legacy_keys: relevant_content[key] = local_config.get(key) + caplog.set_level(logging.WARNING, logger="poetry.packages.locker") locker = locker.__class__( lock=locker.lock, @@ -1185,3 +1186,35 @@ def test_lockfile_is_not_rewritten_if_only_poetry_version_changed( content = f.read() assert content == old_content + + +def test_credentials_in_lock_file( + locker: Locker, root: ProjectPackage +) -> None: + package = Package( + "A", + "1.0.0", + source_type="legacy", + source_url="https://user:password@foo.bar", + source_reference="legacy", + ) + + locker.set_lock_data(root, [package]) + + assert locker.contains_credential is True + + +def test_no_credentials_in_lock_file( + locker: Locker, root: ProjectPackage +) -> None: + package = Package( + "A", + "1.0.0", + source_type="legacy", + source_url="https://foo.bar", + source_reference="legacy", + ) + + locker.set_lock_data(root, [package]) + + assert locker.contains_credential is False From 49d3d95b5cefd1b8ce18a4ce04ad5e1ce50b4463 Mon Sep 17 00:00:00 2001 From: sblondon Date: Tue, 24 May 2022 09:25:38 +0200 Subject: [PATCH 2/4] Improve warning message Co-authored-by: Bjorn Neergaard --- src/poetry/packages/locker.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/poetry/packages/locker.py b/src/poetry/packages/locker.py index f9daaf1fb66..0a48de2cd81 100644 --- a/src/poetry/packages/locker.py +++ b/src/poetry/packages/locker.py @@ -288,7 +288,7 @@ def _should_write(self, lock: TOMLDocument) -> bool: def _write_lock_data(self, data: TOMLDocument) -> None: if self.contains_credential: logger.warning( - "Credential was provided in packages list. It's included in the lock file." + "A package URL contains credentials, which will be included in poetry.lock." ) lockfile = TOMLFile(self.lock) lockfile.write(data) From 8dd515d4f92fd0c2aa19a66a55bcf9a148d1b0cf Mon Sep 17 00:00:00 2001 From: sblondon Date: Sat, 4 Jun 2022 14:26:57 +0200 Subject: [PATCH 3/4] Improve warning message Co-authored-by: Bjorn Neergaard --- src/poetry/packages/locker.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/poetry/packages/locker.py b/src/poetry/packages/locker.py index 0a48de2cd81..1650dd8ab78 100644 --- a/src/poetry/packages/locker.py +++ b/src/poetry/packages/locker.py @@ -288,7 +288,7 @@ def _should_write(self, lock: TOMLDocument) -> bool: def _write_lock_data(self, data: TOMLDocument) -> None: if self.contains_credential: logger.warning( - "A package URL contains credentials, which will be included in poetry.lock." + "A package URL contains credentials and will be written to poetry.lock." ) lockfile = TOMLFile(self.lock) lockfile.write(data) From e7fd7ef337dac63b913d676596dd13b764375233 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Blondon?= Date: Sun, 5 Jun 2022 12:42:32 +0200 Subject: [PATCH 4/4] contains_credential attribute becomes private --- src/poetry/packages/locker.py | 6 +++--- tests/helpers.py | 2 +- tests/installation/test_installer.py | 2 +- tests/packages/test_locker.py | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/poetry/packages/locker.py b/src/poetry/packages/locker.py index 1650dd8ab78..c4cc14fb050 100644 --- a/src/poetry/packages/locker.py +++ b/src/poetry/packages/locker.py @@ -58,7 +58,7 @@ def __init__(self, lock: Path, local_config: dict[str, Any]) -> None: self._local_config = local_config self._lock_data: dict[str, Any] | None = None self._content_hash = self._get_content_hash() - self.contains_credential = False + self._contains_credential = False @property def lock(self) -> Path: @@ -286,7 +286,7 @@ def _should_write(self, lock: TOMLDocument) -> bool: return do_write def _write_lock_data(self, data: TOMLDocument) -> None: - if self.contains_credential: + if self._contains_credential: logger.warning( "A package URL contains credentials and will be written to poetry.lock." ) @@ -460,7 +460,7 @@ def _dump_package(self, package: Package) -> dict[str, Any]: if package.source_url: url = package.source_url - self.contains_credential |= bool(re.match("[a-z]+://.*:.*@.*", url)) + self._contains_credential |= bool(re.match("[a-z]+://.*:.*@.*", url)) if package.source_type in ["file", "directory"]: # The lock file should only store paths relative to the root project url = Path( diff --git a/tests/helpers.py b/tests/helpers.py index 97451f333ca..2fbc4c72bfc 100644 --- a/tests/helpers.py +++ b/tests/helpers.py @@ -190,7 +190,7 @@ def __init__(self, lock: Path, local_config: dict[str, Any]) -> None: super().__init__(lock, local_config) self._locked = False self._write = False - self.contains_credential = False + self._contains_credential = False def write(self, write: bool = True) -> None: self._write = write diff --git a/tests/installation/test_installer.py b/tests/installation/test_installer.py index 27232379d43..d5153b4c5ac 100644 --- a/tests/installation/test_installer.py +++ b/tests/installation/test_installer.py @@ -102,7 +102,7 @@ def __init__(self, lock_path: Path) -> None: self._locked = False self._lock_data = None self._content_hash = self._get_content_hash() - self.contains_credential = False + self._contains_credential = False @property def written_data(self) -> dict[str, Any]: diff --git a/tests/packages/test_locker.py b/tests/packages/test_locker.py index e6d13560b6b..3ba8b43dc15 100644 --- a/tests/packages/test_locker.py +++ b/tests/packages/test_locker.py @@ -1201,7 +1201,7 @@ def test_credentials_in_lock_file( locker.set_lock_data(root, [package]) - assert locker.contains_credential is True + assert locker._contains_credential is True def test_no_credentials_in_lock_file( @@ -1217,4 +1217,4 @@ def test_no_credentials_in_lock_file( locker.set_lock_data(root, [package]) - assert locker.contains_credential is False + assert locker._contains_credential is False