sec(starship): gate drconfig prompt segment on work flag - #176
Open
github-actions[bot] wants to merge 1 commit into
Open
sec(starship): gate drconfig prompt segment on work flag#176github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
The Starship custom.drconfig segment rendered the DataRobot endpoint hostname whenever ~/.config/datarobot/drconfig.yaml existed. This leaked internal infrastructure hostnames through screenshots, screen sharing, or recorded terminal sessions on any machine that happened to have the file, not just work machines. Gate the segment on the chezmoi work data flag so it is disabled by default on non-work machines and only renders when .work is true. The SECURITY NOTE is updated to document the new gating behavior. Closes #175
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated fix attempt
This PR was generated by the
droid-issue-fixerGitHub Action, which runsdroid execheadlessly to attempt an open issue.Closes #175
Droid exec summary
Gated the Starship
custom.drconfigprompt segment on the chezmoiworkdata flag so it only renders on work machines.The segment previously ran whenever
~/.config/datarobot/drconfig.yamlexisted andyqwas installed, which leaked internal DataRobot endpoint hostnames through screenshots, screen sharing, or recorded terminal sessions on any machine with that file. Now the segment setsdisabled = trueon non-work machines anddisabled = falseonly when.workistrue. The existingSECURITY NOTEis updated to document the new gating behavior.Validated by rendering the template with both
work = falseandwork = trueconfigs usingchezmoi execute-template; both outputs parse as valid TOML.Closes #175