fix(cloudflare): cf-as 擋掉夾帶空白的唯讀 token,不只擋空值 - #12
Merged
Conversation
[ -z "$token" ] 只擋得住空字串。全是空白的值會被當成有效 token export 成
CLOUDFLARE_API_TOKEN,把 Authorization 塌成裸 Bearer,直到 API 層才以認證失敗收場;夾帶
LF 或 CR 的值更早壞掉,Go 的 net/http 在連線前就以 `net/http: invalid header field value
for "Authorization"` 拒絕,錯誤訊息指不到 Doppler 也指不到呼叫端。
Cloudflare API token 的字元集不含空白(provider 5.22 對 api_token 的驗證式是
^[0-9A-Za-z\-_]{40,80}$),所以值裡出現空白一定代表這份機密被填壞了。注入路徑
(Doppler env 格式只轉義 \ 與 ",加上 zsh.envExtra 的 set -a + source)會原樣保留空白與
換行,三種形狀都真的到得了這裡。
改成 case 擋 "" 與 *[[:space:]]*,語意與 home-lab cloudflare/.mise/tasks/lib/cf-auth 的
cf_token_is_valid 一致。刻意只驗證、不 trim 後照用:靜默改掉一份壞掉的憑證只會讓「為什麼
認證失敗」更難查。Doppler 那兩行修法照舊,只有第一行「是空的」不再準確,跟著改掉。
帳號->變數名的跨 repo 重複維持原樣,見檔頭註解與 home-lab cloudflare/README.md。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[ -z "$token" ] 只擋得住空字串。全是空白的值會被當成有效 token export 成 CLOUDFLARE_API_TOKEN,把 Authorization 塌成裸 Bearer,直到 API 層才以認證失敗收場;夾帶 LF 或 CR 的值更早壞掉,Go 的 net/http 在連線前就以
net/http: invalid header field value for "Authorization"拒絕,錯誤訊息指不到 Doppler 也指不到呼叫端。Cloudflare API token 的字元集不含空白(provider 5.22 對 api_token 的驗證式是 ^[0-9A-Za-z-_]{40,80}$),所以值裡出現空白一定代表這份機密被填壞了。注入路徑 (Doppler env 格式只轉義 \ 與 ",加上 zsh.envExtra 的 set -a + source)會原樣保留空白與 換行,三種形狀都真的到得了這裡。
改成 case 擋 "" 與 [[:space:]],語意與 home-lab cloudflare/.mise/tasks/lib/cf-auth 的 cf_token_is_valid 一致。刻意只驗證、不 trim 後照用:靜默改掉一份壞掉的憑證只會讓「為什麼 認證失敗」更難查。Doppler 那兩行修法照舊,只有第一行「是空的」不再準確,跟著改掉。
帳號->變數名的跨 repo 重複維持原樣,見檔頭註解與 home-lab cloudflare/README.md。