{"action":"created","issue":{"url":"https://api.github.com/repos/ros-infrastructure/bloom/issues/411","repository_url":"https://api.github.com/repos/ros-infrastructure/bloom","labels_url":"https://api.github.com/repos/ros-infrastructure/bloom/issues/411/labels{/name}","comments_url":"https://api.github.com/repos/ros-infrastructure/bloom/issues/411/comments","events_url":"https://api.github.com/repos/ros-infrastructure/bloom/issues/411/events","html_url":"https://github.com/ros-infrastructure/bloom/issues/411","id":189205401,"number":411,"title":"Security Vulnerability with OAuth Token","user":{"login":"davetcoleman","id":561060,"avatar_url":"https://avatars.githubusercontent.com/u/561060?v=3","gravatar_id":"","url":"https://api.github.com/users/davetcoleman","html_url":"https://github.com/davetcoleman","followers_url":"https://api.github.com/users/davetcoleman/followers","following_url":"https://api.github.com/users/davetcoleman/following{/other_user}","gists_url":"https://api.github.com/users/davetcoleman/gists{/gist_id}","starred_url":"https://api.github.com/users/davetcoleman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davetcoleman/subscriptions","organizations_url":"https://api.github.com/users/davetcoleman/orgs","repos_url":"https://api.github.com/users/davetcoleman/repos","events_url":"https://api.github.com/users/davetcoleman/events{/privacy}","received_events_url":"https://api.github.com/users/davetcoleman/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-11-14T19:40:18Z","updated_at":"2016-11-17T18:22:06Z","closed_at":null,"body":"@tfoote suggested [here](https://github.com/ros-planning/moveit/issues/18#issuecomment-259538908) that I \"retain the logs and console output [of bloom] in case there's still a problem\" when releasing moveit, so I did. I wanted to share with @130s so I created a public gist but this morning Github emailed me saying \"OAuth access token found in Gist\" with the details:\r\n\r\n> Publicly disclosing a valid access token would allow other people to interact with GitHub on your behalf, potentially altering data, your contact information, and billing data.\r\n\r\nI had no idea my token was in the console output and this seems like a security flaw, just as a plain text password in a console would be. I suggest we change the output to hide the token since many users, like me, might not realize the consequences of using gist for this.\r\n\r\nNote that the Github emails then said \"As a precautionary measure, we have revoked the OAuth token.\" so I think I'm fine."},"comment":{"url":"https://api.github.com/repos/ros-infrastructure/bloom/issues/comments/261326228","html_url":"https://github.com/ros-infrastructure/bloom/issues/411#issuecomment-261326228","issue_url":"https://api.github.com/repos/ros-infrastructure/bloom/issues/411","id":261326228,"user":{"login":"davetcoleman","id":561060,"avatar_url":"https://avatars.githubusercontent.com/u/561060?v=3","gravatar_id":"","url":"https://api.github.com/users/davetcoleman","html_url":"https://github.com/davetcoleman","followers_url":"https://api.github.com/users/davetcoleman/followers","following_url":"https://api.github.com/users/davetcoleman/following{/other_user}","gists_url":"https://api.github.com/users/davetcoleman/gists{/gist_id}","starred_url":"https://api.github.com/users/davetcoleman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davetcoleman/subscriptions","organizations_url":"https://api.github.com/users/davetcoleman/orgs","repos_url":"https://api.github.com/users/davetcoleman/repos","events_url":"https://api.github.com/users/davetcoleman/events{/privacy}","received_events_url":"https://api.github.com/users/davetcoleman/received_events","type":"User","site_admin":false},"created_at":"2016-11-17T18:22:05Z","updated_at":"2016-11-17T18:22:05Z","body":"@tfoote that's a cool gitconfig setting - I've added that to my environment! \r\n\r\n@wjwwood what if you just hide that output of that command? ``git push ... > /dev/null``. I suppose that would hide useful commands, though. \r\n\r\nRequiring ssh keys to be setup seems reasonable for an advanced tool like bloom - I wonder what low percentage of ROS maintainers haven't already done that..."}}
{"actor":{"display_login":"davetcoleman"}}