Validate registry token before operations that require it. #6854

fluffysquirrels · 2019-04-15T20:43:53Z

Fixes #6847 .

rust-highfive · 2019-04-15T20:44:03Z

Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @alexcrichton (or someone else) soon.

If any changes to this PR are deemed necessary, please add them as extra commits. This ensures that the reviewer can see what has changed since they last reviewed the code. Due to the way GitHub handles out-of-date commits, this should also make it reasonably obvious what issues have or haven't been addressed. Large or tricky changes may require several passes of review and changes.

Please see the contribution instructions for more information.

fluffysquirrels · 2019-04-15T20:46:41Z

src/cargo/ops/registry.rs

@@ -334,12 +335,13 @@ pub fn registry_configuration(
    Ok(RegistryConfig { index, token })
 }

-pub fn registry(
+fn registry(


fn registry isn't called outside this file and is already a bit gnarly and specific in its usage, so I thought it might be best made private.

fluffysquirrels · 2019-04-15T20:53:17Z

src/cargo/ops/registry.rs

    config: &Config,
    token: Option<String>,
    index: Option<String>,
    registry: Option<String>,
    force_update: bool,
+    validate_token: bool


I added the token validation to fn registry because it seemed useful for several callers, but also because once the token is wrapped in a Registry private field we can't read it without bulkier changes that didn't seem justified.

fluffysquirrels · 2019-04-15T20:54:19Z

tests/testsuite/alt_registry.rs

@@ -289,6 +289,9 @@ fn cannot_publish_to_crates_io_with_registry_dependency() {
        )
        .build();

+    // Login so that we have the token available


This test failed at an earlier point without access to the fake registry's token.

alexcrichton · 2019-04-16T14:12:04Z

Thanks for the PR! Mind adding a test for specifically this as well?

fluffysquirrels · 2019-04-16T16:54:27Z

How's this: f7c424f ?

alexcrichton · 2019-04-17T14:14:55Z

@bors: r+

Thanks!

bors · 2019-04-17T14:14:56Z

📌 Commit f7c424f has been approved by alexcrichton

bors · 2019-04-17T14:56:29Z

⌛ Testing commit f7c424f with merge 6dce2aa...

Validate registry token before operations that require it. Fixes #6847 .

bors · 2019-04-17T15:34:46Z

☀️ Test successful - checks-travis, status-appveyor
Approved by: alexcrichton
Pushing 6dce2aa to master...

bjorn3 · 2019-04-17T15:43:17Z

Thanks @fluffysquirrels!

…chton Update cargo, books ## cargo 5 commits in b6581d383ed596b133e330011658c6f83cf85c2f..6be12653dcefb46ee7b605f063ee75b5e6cba513 2019-04-16 16:02:11 +0000 to 2019-04-19 15:05:03 +0000 - Improved docs for `maintenance` options (rust-lang/cargo#6863) - publish-lockfile: Various updates (rust-lang/cargo#6840) - Treat HTTP/2 stream errors as spurious network errors. (rust-lang/cargo#6861) - Validate registry token before operations that require it. (rust-lang/cargo#6854) - Cleanups wrt DYLD_FALLBACK_LIBRARY_PATH handling (rust-lang/cargo#6856) ## reference 2 commits in 98f90ff..2a2de9c 2019-04-06 09:29:08 -0700 to 2019-04-22 10:25:52 -0700 - Remove unused link references. (rust-lang/reference#560) - Fix attribute redirects. (rust-lang/reference#562) ## book 22 commits in b93ec30bbc7b1b5c2f44223249ab359bed2ed5a6..db919bc6bb9071566e9c4f05053672133eaac33e 2019-03-26 16:54:10 -0400 to 2019-04-15 20:11:03 -0400 - Link to chapters mentioned in chapter 12 - Split up a long sentence - Unclear wording 4.3 (rust-lang/book#1907) - Corrected error for array out of bounds (rust-lang/book#1900) - Make lifetime explanation clearer (rust-lang/book#1901) - Replace `T: 'a + Messenger` with `T: Messenger` (rust-lang/book#1831) - Update range so matches rust-fmt . (rust-lang/book#1890) - Adding trailing comma (rust-lang/book#1891) - point 2018 book redirects to existing pages instead of index (rust-lang/book#1919) - Update ch04-03-slices.md (rust-lang/book#1921) - Update link for Russian translation. (rust-lang/book#1915) - Ch7 layout (rust-lang/book#1917) - Update the version of mdbook we use in-tree to match rust-lang/rust (rust-lang/book#1912) - Fix spellingz - Update listings in ch 19-6 for nostarch - Add a high-level overview of the changes in this version of the book - Fix Travis CI badge url (rust-lang/book#1893) - Redo listing numbers in chapter 19 after removals - Remove Advanced Lifetimes section completely - Merge branch 'gh1780' - Merge remote-tracking branch 'origin/master' into gh1567 - remove lifetime subtyping ## rust-by-example 4 commits in f68ef3d0f4959f6a7d92a08d9994b117f0f4d32d..1ff0f8e018838a710ebc0cc1a7bf74ebe73ad9f1 2019-03-12 15:32:12 -0300 to 2019-04-15 08:15:32 -0300 - Fix borrow so it fails in 2018 edition Fixes rust-lang/rust-by-example#1141 (rust-lang/rust-by-example#1152) - Replace lvalue and rvalue with place and value (rust-lang/rust-by-example#1160) - Mutate array in iter_mut() example (rust-lang/rust-by-example#1165) - Fix a typo ("half" -> "halve") (rust-lang/rust-by-example#1172) ## rustc-guide 8 commits in 464cb5b166378dff64619081dd4c42533a1eb989..99e1b1d53656be08654df399fc200584aebb50e4 2019-03-23 18:39:14 -0500 to 2019-04-20 09:57:54 -0500 - Update BodyId description - Update test-implementation chapter to current code - update chalk with new organization - move to subsection - fix MovePathIndex link - Update query chapter for the query macro rewrite - subchapter with information about `--error-format json` - Update query-evaluation-model-in-detail.md ## edition-guide 1 commits in b56ddb11548450a6df4edd1ed571b2bc304eb9e6..c413d42a207bd082f801ec0137c31b71e4bfed4c 2019-03-10 10:23:16 +0100 to 2019-04-22 01:14:56 +0200 - fix command (rust-lang/edition-guide#155) ## embedded-book 1 commits in 7989c723607ef5b13b57208022259e6c771e11d0..de3d55f521e657863df45260ebbca1b10527f662 2019-04-04 12:14:37 +0000 to 2019-04-22 12:58:28 +0000 - Minor fixes (rust-embedded/book#185) ## nomicon 6 commits in c02e0e7754a76886e55b976a3a4fac20100cd35d..fb29b147be4d9a1f8e24aba753a7e1de537abf61 2019-03-25 16:52:56 -0400 to 2019-04-22 19:10:29 -0400 - Fix link to copy_nonoverlapping (rust-lang/nomicon#134) - Various unchecked-uninit improvements (rust-lang/nomicon#130) - OOM behaviour in `vec-alloc.md` (rust-lang/nomicon#133) - Added missing "things". (rust-lang/nomicon#131) - Fix number agreement in subtyping chapter (rust-lang/nomicon#128) - Minor improvements (rust-lang/nomicon#129)

Update cargo, books ## cargo 5 commits in b6581d383ed596b133e330011658c6f83cf85c2f..6be12653dcefb46ee7b605f063ee75b5e6cba513 2019-04-16 16:02:11 +0000 to 2019-04-19 15:05:03 +0000 - Improved docs for `maintenance` options (rust-lang/cargo#6863) - publish-lockfile: Various updates (rust-lang/cargo#6840) - Treat HTTP/2 stream errors as spurious network errors. (rust-lang/cargo#6861) - Validate registry token before operations that require it. (rust-lang/cargo#6854) - Cleanups wrt DYLD_FALLBACK_LIBRARY_PATH handling (rust-lang/cargo#6856) ## reference 2 commits in 98f90ff..2a2de9c 2019-04-06 09:29:08 -0700 to 2019-04-22 10:25:52 -0700 - Remove unused link references. (rust-lang/reference#560) - Fix attribute redirects. (rust-lang/reference#562) ## book 22 commits in b93ec30bbc7b1b5c2f44223249ab359bed2ed5a6..db919bc6bb9071566e9c4f05053672133eaac33e 2019-03-26 16:54:10 -0400 to 2019-04-15 20:11:03 -0400 - Link to chapters mentioned in chapter 12 - Split up a long sentence - Unclear wording 4.3 (rust-lang/book#1907) - Corrected error for array out of bounds (rust-lang/book#1900) - Make lifetime explanation clearer (rust-lang/book#1901) - Replace `T: 'a + Messenger` with `T: Messenger` (rust-lang/book#1831) - Update range so matches rust-fmt . (rust-lang/book#1890) - Adding trailing comma (rust-lang/book#1891) - point 2018 book redirects to existing pages instead of index (rust-lang/book#1919) - Update ch04-03-slices.md (rust-lang/book#1921) - Update link for Russian translation. (rust-lang/book#1915) - Ch7 layout (rust-lang/book#1917) - Update the version of mdbook we use in-tree to match rust-lang/rust (rust-lang/book#1912) - Fix spellingz - Update listings in ch 19-6 for nostarch - Add a high-level overview of the changes in this version of the book - Fix Travis CI badge url (rust-lang/book#1893) - Redo listing numbers in chapter 19 after removals - Remove Advanced Lifetimes section completely - Merge branch 'gh1780' - Merge remote-tracking branch 'origin/master' into gh1567 - remove lifetime subtyping ## rust-by-example 4 commits in f68ef3d0f4959f6a7d92a08d9994b117f0f4d32d..1ff0f8e018838a710ebc0cc1a7bf74ebe73ad9f1 2019-03-12 15:32:12 -0300 to 2019-04-15 08:15:32 -0300 - Fix borrow so it fails in 2018 edition Fixes rust-lang/rust-by-example#1141 (rust-lang/rust-by-example#1152) - Replace lvalue and rvalue with place and value (rust-lang/rust-by-example#1160) - Mutate array in iter_mut() example (rust-lang/rust-by-example#1165) - Fix a typo ("half" -> "halve") (rust-lang/rust-by-example#1172) ## rustc-guide 8 commits in 464cb5b166378dff64619081dd4c42533a1eb989..99e1b1d53656be08654df399fc200584aebb50e4 2019-03-23 18:39:14 -0500 to 2019-04-20 09:57:54 -0500 - Update BodyId description - Update test-implementation chapter to current code - update chalk with new organization - move to subsection - fix MovePathIndex link - Update query chapter for the query macro rewrite - subchapter with information about `--error-format json` - Update query-evaluation-model-in-detail.md ## edition-guide 1 commits in b56ddb11548450a6df4edd1ed571b2bc304eb9e6..c413d42a207bd082f801ec0137c31b71e4bfed4c 2019-03-10 10:23:16 +0100 to 2019-04-22 01:14:56 +0200 - fix command (rust-lang/edition-guide#155) ## embedded-book 1 commits in 7989c723607ef5b13b57208022259e6c771e11d0..de3d55f521e657863df45260ebbca1b10527f662 2019-04-04 12:14:37 +0000 to 2019-04-22 12:58:28 +0000 - Minor fixes (rust-embedded/book#185) ## nomicon 6 commits in c02e0e7754a76886e55b976a3a4fac20100cd35d..fb29b147be4d9a1f8e24aba753a7e1de537abf61 2019-03-25 16:52:56 -0400 to 2019-04-22 19:10:29 -0400 - Fix link to copy_nonoverlapping (rust-lang/nomicon#134) - Various unchecked-uninit improvements (rust-lang/nomicon#130) - OOM behaviour in `vec-alloc.md` (rust-lang/nomicon#133) - Added missing "things". (rust-lang/nomicon#131) - Fix number agreement in subtyping chapter (rust-lang/nomicon#128) - Minor improvements (rust-lang/nomicon#129)

Validate registry token before operations that require it.

d9bc8c0

rust-highfive assigned alexcrichton Apr 15, 2019

rust-highfive added the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Apr 15, 2019

fluffysquirrels commented Apr 15, 2019

View reviewed changes

fluffysquirrels marked this pull request as ready for review April 15, 2019 20:54

Add check token before verify tests.

f7c424f

bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Apr 17, 2019

bors added a commit that referenced this pull request Apr 17, 2019

Auto merge of #6854 - fluffysquirrels:validate-login, r=alexcrichton

6dce2aa

Validate registry token before operations that require it. Fixes #6847 .

bors merged commit f7c424f into rust-lang:master Apr 17, 2019

ehuss mentioned this pull request Apr 22, 2019

Update cargo, books rust-lang/rust#60180

Merged

ehuss mentioned this pull request Apr 25, 2019

cargo publish warns about tokens after doing a build #6877

Closed

ehuss added this to the 1.36.0 milestone Feb 6, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Validate registry token before operations that require it. #6854

Validate registry token before operations that require it. #6854

fluffysquirrels commented Apr 15, 2019

rust-highfive commented Apr 15, 2019

fluffysquirrels Apr 15, 2019

fluffysquirrels Apr 15, 2019

fluffysquirrels Apr 15, 2019

alexcrichton commented Apr 16, 2019

fluffysquirrels commented Apr 16, 2019

alexcrichton commented Apr 17, 2019

bors commented Apr 17, 2019

bors commented Apr 17, 2019

bors commented Apr 17, 2019

bjorn3 commented Apr 17, 2019

Validate registry token before operations that require it. #6854

Validate registry token before operations that require it. #6854

Conversation

fluffysquirrels commented Apr 15, 2019

rust-highfive commented Apr 15, 2019

fluffysquirrels Apr 15, 2019

Choose a reason for hiding this comment

fluffysquirrels Apr 15, 2019

Choose a reason for hiding this comment

fluffysquirrels Apr 15, 2019

Choose a reason for hiding this comment

alexcrichton commented Apr 16, 2019

fluffysquirrels commented Apr 16, 2019

alexcrichton commented Apr 17, 2019

bors commented Apr 17, 2019

bors commented Apr 17, 2019

bors commented Apr 17, 2019

bjorn3 commented Apr 17, 2019