{"action":"opened","issue":{"url":"https://api.github.com/repos/yarnpkg/yarn/issues/5344","repository_url":"https://api.github.com/repos/yarnpkg/yarn","labels_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5344/labels{/name}","comments_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5344/comments","events_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5344/events","html_url":"https://github.com/yarnpkg/yarn/issues/5344","id":295810462,"number":5344,"title":"yarn config list prints _auth/_password/_authToken when configured via npmrc","user":{"login":"bgotink","id":821510,"avatar_url":"https://avatars1.githubusercontent.com/u/821510?v=4","gravatar_id":"","url":"https://api.github.com/users/bgotink","html_url":"https://github.com/bgotink","followers_url":"https://api.github.com/users/bgotink/followers","following_url":"https://api.github.com/users/bgotink/following{/other_user}","gists_url":"https://api.github.com/users/bgotink/gists{/gist_id}","starred_url":"https://api.github.com/users/bgotink/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bgotink/subscriptions","organizations_url":"https://api.github.com/users/bgotink/orgs","repos_url":"https://api.github.com/users/bgotink/repos","events_url":"https://api.github.com/users/bgotink/events{/privacy}","received_events_url":"https://api.github.com/users/bgotink/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-09T09:46:14Z","updated_at":"2018-02-09T09:46:14Z","closed_at":null,"author_association":"NONE","body":"<!-- *Before creating an issue please make sure you are using the latest version of yarn.* -->\r\n\r\n**Do you want to request a *feature* or report a *bug*?**\r\n\r\nI'm not sure whether to categorize this as bug or feature.\r\n\r\n**What is the current behavior?**\r\n\r\n`yarn config list` prints sensitive information contained in npm configuration. The same sensitive information is not printed when configured in the yarn configuration.\r\n\r\nUsecase: our jenkins pipeline prints environment information as a first stage to allow easy debugging of build failures due to a wrong setup, e.g. wrong version of node or yarn, incorrect yarn configuration. Our configuration is included in `.npmrc` files to allow pipeline creators to choose between npm and yarn.  \r\nRight now we've got `yarn config list | grep -v -e _auth -e _password -e _authToken` but that leads to a weird broken json-ish output if any of those properties are first or last in the configuration, e.g.\r\n\r\n```\r\nyarn config v1.3.2\r\ninfo yarn config\r\n{ 'version-tag-prefix': 'v',\r\n  'version-git-tag': true,\r\n  'version-git-sign': false,\r\n  'version-git-message': 'v%s',\r\n  'init-version': '1.0.0',\r\n  'init-license': 'UNLICENSED',\r\n  'save-prefix': '',\r\n  'ignore-scripts': false,\r\n  'ignore-optional': false,\r\n  registry: 'https://my.custom.registry/',\r\n  'strict-ssl': true,\r\n  'user-agent': 'yarn/1.3.2 npm/? node/v8.9.4 darwin x64',\r\n  'always-auth': true,\r\n  lastUpdateCheck: 1518168544250 }\r\ninfo npm config\r\n{ registry: 'https://my.custom.registry/',\r\n  'always-auth': true, <-- _auth is removed by grep after this line\r\nDone in 0.03s.\r\n```\r\n\r\n**What is the expected behavior?**\r\n\r\nI expect `yarn config list` to not print sensitive information, regardless of whether that information is configured in a `.yarnrc` or `.npmrc`.\r\n\r\n**Please mention your node.js, yarn and operating system version.**\r\n\r\nyarn versions 1.3.2, 1.4.0"}}
{"actor":{"display_login":"bgotink"}}