icecrime / label-all-the-things Goto Github PK

label-all-the-things defines a flag called "token" that allows a caller to specify a GitHub API token to use for authentication. When the caller supplies such a flag, label-all-the-things reads it improperly, causing it to proceed with an empty token value, thus preventing the intended authentication from succeeding.

The problem is in the getGitHubToken function. It checks to see whether the caller supplied a nonempty value for the "token" flag and, if so, proceeds to look up the value for a flag with the name of the "token" flag's value, which is not likely to exist.

if v := c.GlobalString("token"); v != "" {
    return c.GlobalString(v)
}

Hence, if a caller invokes

label-all-the-things --token xxx create --labels common.json icecrime/label-all-the-things

then getGitHubToken will look up the value for the nonexistent flag "xxx". If there was a string-typed flag named "xxx" defined, one could write the following:

label-all-the-things --token xxx -xxx my-real-token create --labels common.json icecrime/label-all-the-things

The program would then use "my-real-token" as the GitHub API token.

Instead, that portion of getGitHubToken should read as follows:

if v := c.GlobalString("token"); v != "" {
    return v
}

Thanks to @cmluciano for discovering this problem.