feat(connections): resolve connection passwords from file, env, or command (#1254) #1478
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,237 @@ | ||
| // | ||
| // PasswordSourceResolver.swift | ||
| // TablePro | ||
| // | ||
|
|
||
| import Foundation | ||
| import os | ||
|
|
||
| /// Resolves a connection password from an external source declared in connections.json. | ||
| /// File and command sources require a non-sandboxed build; TablePro ships with the hardened | ||
| /// runtime and no App Sandbox, so spawning a process and reading arbitrary files is allowed. | ||
| enum PasswordSourceResolver { | ||
| private static let logger = Logger(subsystem: "com.TablePro", category: "PasswordSourceResolver") | ||
|
|
||
| private static let commandTimeoutSeconds: UInt64 = 30 | ||
| private static let maxOutputBytes = 1_048_576 | ||
|
|
||
| enum ResolutionError: LocalizedError { | ||
| case fileNotFound(path: String) | ||
| case fileUnreadable(path: String) | ||
| case environmentVariableNotSet(name: String) | ||
| case commandFailed(exitCode: Int32, stderr: String) | ||
| case commandTimedOut | ||
| case outputTooLarge | ||
| case emptyPassword | ||
|
|
||
| var errorDescription: String? { | ||
| switch self { | ||
| case let .fileNotFound(path): | ||
| return String(format: String(localized: "Password file not found: %@"), path) | ||
| case let .fileUnreadable(path): | ||
| return String(format: String(localized: "Could not read password file: %@"), path) | ||
| case let .environmentVariableNotSet(name): | ||
| return String( | ||
| format: String(localized: """ | ||
| Environment variable %@ is not set in TablePro's environment. \ | ||
| Apps launched from the Dock do not inherit shell exports. Launch TablePro \ | ||
| from a terminal, or set the variable with launchctl setenv. | ||
| """), | ||
| name | ||
| ) | ||
| case let .commandFailed(exitCode, stderr): | ||
| let message = stderr.trimmingCharacters(in: .whitespacesAndNewlines) | ||
| if message.isEmpty { | ||
| return String(format: String(localized: "Password command failed with exit code %d"), exitCode) | ||
| } | ||
| return String(format: String(localized: "Password command failed (exit %d): %@"), exitCode, message) | ||
| case .commandTimedOut: | ||
| return String(localized: "Password command timed out after 30 seconds") | ||
| case .outputTooLarge: | ||
| return String(localized: "Password command produced too much output") | ||
| case .emptyPassword: | ||
| return String(localized: "The password source produced an empty password") | ||
| } | ||
| } | ||
| } | ||
|
|
||
| static func resolve(_ source: PasswordSource) async throws -> String { | ||
| switch source { | ||
| case let .file(path): | ||
| return try resolveFile(path: path) | ||
| case let .env(variable): | ||
| return try resolveEnvironment(variable: variable) | ||
| case let .command(shell): | ||
| return try await resolveCommand(shell: shell, timeoutSeconds: commandTimeoutSeconds) | ||
| } | ||
| } | ||
|
|
||
| private static func resolveFile(path: String) throws -> String { | ||
| let expandedPath = (path as NSString).expandingTildeInPath | ||
| guard FileManager.default.fileExists(atPath: expandedPath) else { | ||
| throw ResolutionError.fileNotFound(path: expandedPath) | ||
| } | ||
| warnIfPermissionsInsecure(path: expandedPath) | ||
| guard let contents = try? String(contentsOfFile: expandedPath, encoding: .utf8) else { | ||
| throw ResolutionError.fileUnreadable(path: expandedPath) | ||
| } | ||
| return try nonEmpty(contents.trimmingCharacters(in: .whitespacesAndNewlines)) | ||
|
There was a problem hiding this comment.
For file-based password sources, trimming Useful? React with 👍 / 👎. |
||
| } | ||
|
|
||
| private static func resolveEnvironment(variable: String) throws -> String { | ||
| guard let value = ProcessInfo.processInfo.environment[variable] else { | ||
| throw ResolutionError.environmentVariableNotSet(name: variable) | ||
| } | ||
| return try nonEmpty(value.trimmingCharacters(in: .whitespacesAndNewlines)) | ||
| } | ||
|
|
||
| static func resolveCommand(shell: String, timeoutSeconds: UInt64) async throws -> String { | ||
| let output = try await Task.detached(priority: .userInitiated) { () throws -> String in | ||
| let process = Process() | ||
| process.executableURL = URL(fileURLWithPath: "/bin/bash") | ||
| process.arguments = ["-c", shell] | ||
| process.environment = augmentedEnvironment() | ||
| process.standardInput = FileHandle.nullDevice | ||
|
|
||
| let stdoutPipe = Pipe() | ||
| let stderrPipe = Pipe() | ||
| process.standardOutput = stdoutPipe | ||
| process.standardError = stderrPipe | ||
|
|
||
| let stdoutCollector = PipeDataCollector(maxBytes: maxOutputBytes) | ||
| let stderrCollector = PipeDataCollector(maxBytes: maxOutputBytes) | ||
| stdoutPipe.fileHandleForReading.readabilityHandler = { handle in | ||
| let chunk = handle.availableData | ||
| guard !chunk.isEmpty else { return } | ||
| stdoutCollector.append(chunk) | ||
| if stdoutCollector.overflowed, process.isRunning { | ||
| process.terminate() | ||
| } | ||
| } | ||
| stderrPipe.fileHandleForReading.readabilityHandler = { handle in | ||
| let chunk = handle.availableData | ||
| if !chunk.isEmpty { stderrCollector.append(chunk) } | ||
| } | ||
|
|
||
| try process.run() | ||
|
|
||
| let didTimeout = AtomicFlag() | ||
| let timeoutTask = Task.detached { | ||
| try await Task.sleep(nanoseconds: timeoutSeconds * 1_000_000_000) | ||
| if process.isRunning { | ||
| didTimeout.set() | ||
| process.terminate() | ||
| } | ||
|
Comment on lines
+121
to
+124
There was a problem hiding this comment.
For a password command that traps or ignores SIGTERM, this timeout path sets the flag and calls Useful? React with 👍 / 👎. |
||
| } | ||
|
|
||
| process.waitUntilExit() | ||
| timeoutTask.cancel() | ||
|
|
||
| stdoutPipe.fileHandleForReading.readabilityHandler = nil | ||
| stderrPipe.fileHandleForReading.readabilityHandler = nil | ||
|
|
||
| if stdoutCollector.overflowed { | ||
| throw ResolutionError.outputTooLarge | ||
| } | ||
| if didTimeout.isSet { | ||
| throw ResolutionError.commandTimedOut | ||
| } | ||
| if process.terminationStatus != 0 { | ||
| throw ResolutionError.commandFailed( | ||
| exitCode: process.terminationStatus, | ||
| stderr: stderrCollector.string | ||
| ) | ||
| } | ||
| return stdoutCollector.string | ||
| }.value | ||
|
|
||
| guard !output.contains("\0") else { | ||
| throw ResolutionError.emptyPassword | ||
| } | ||
| return try nonEmpty(output.trimmingCharacters(in: .whitespacesAndNewlines)) | ||
| } | ||
|
|
||
| private static func augmentedEnvironment() -> [String: String] { | ||
| var environment = ProcessInfo.processInfo.environment | ||
| let toolPaths = ["/usr/local/bin", "/opt/homebrew/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"] | ||
| var pathComponents = (environment["PATH"] ?? "").split(separator: ":").map(String.init) | ||
| for toolPath in toolPaths where !pathComponents.contains(toolPath) { | ||
| pathComponents.append(toolPath) | ||
| } | ||
| environment["PATH"] = pathComponents.joined(separator: ":") | ||
| return environment | ||
| } | ||
|
|
||
| private static func warnIfPermissionsInsecure(path: String) { | ||
| guard let attributes = try? FileManager.default.attributesOfItem(atPath: path), | ||
| let permissions = attributes[.posixPermissions] as? Int else { | ||
| return | ||
| } | ||
| if permissions & 0o077 != 0 { | ||
| logger.warning("Password file is group or world accessible; restrict it with chmod 600") | ||
| } | ||
| } | ||
|
|
||
| private static func nonEmpty(_ password: String) throws -> String { | ||
| guard !password.isEmpty else { | ||
| throw ResolutionError.emptyPassword | ||
| } | ||
| return password | ||
| } | ||
| } | ||
|
|
||
| private final class PipeDataCollector: @unchecked Sendable { | ||
| private let lock = NSLock() | ||
| private let maxBytes: Int | ||
| private var data = Data() | ||
| private var didOverflow = false | ||
|
|
||
| init(maxBytes: Int) { | ||
| self.maxBytes = maxBytes | ||
| } | ||
|
|
||
| func append(_ chunk: Data) { | ||
| lock.lock() | ||
| defer { lock.unlock() } | ||
| let remaining = maxBytes - data.count | ||
| guard remaining > 0 else { | ||
| didOverflow = true | ||
| return | ||
| } | ||
| if chunk.count > remaining { | ||
| data.append(chunk.prefix(remaining)) | ||
| didOverflow = true | ||
| } else { | ||
| data.append(chunk) | ||
| } | ||
| } | ||
|
|
||
| var overflowed: Bool { | ||
| lock.lock() | ||
| defer { lock.unlock() } | ||
| return didOverflow | ||
| } | ||
|
|
||
| var string: String { | ||
| lock.lock() | ||
| defer { lock.unlock() } | ||
| return String(data: data, encoding: .utf8) ?? "" | ||
| } | ||
| } | ||
|
|
||
| private final class AtomicFlag: @unchecked Sendable { | ||
| private let lock = NSLock() | ||
| private var value = false | ||
|
|
||
| func set() { | ||
| lock.lock() | ||
| value = true | ||
| lock.unlock() | ||
| } | ||
|
|
||
| var isSet: Bool { | ||
| lock.lock() | ||
| defer { lock.unlock() } | ||
| return value | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When a connection uses SSH or Cloudflare tunneling,
DatabaseManager.tunneledConnection(from:localPort:)rebuilds aDatabaseConnectionfor127.0.0.1beforecreateDrivercalls this password lookup, but that rebuilt connection does not carrypasswordSource. In that environment this new branch is skipped and the driver falls back to Keychain/empty password, so a connection that works directly withpasswordSourcefails as soon as a tunnel is enabled; propagate the source onto the tunneled connection before resolving the password.Useful? React with 👍 / 👎.