From bba82a86b137c73832ad7b6a397d3db24fcc625f Mon Sep 17 00:00:00 2001 From: Simeon Simeonov Date: Thu, 26 Dec 2024 22:58:37 +0100 Subject: Add encrypted values to ETOOLKIT_SENSITIVE implicitly --- CHANGELOG.md | 9 +++++++++ README.md | 4 ++++ setup.cfg | 4 ++-- src/etoolkit/__init__.py | 2 +- src/etoolkit/etoolkit.py | 18 +++++++++++++++--- tests/conftest.py | 5 +++++ tests/test_envtoolkit_instance.py | 4 +++- 7 files changed, 39 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index aca6068..916a9a2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,14 @@ # Changelog +## [2.1.0](https://github.com/blackm0re/etoolkit/tree/2.1.0) (2024-12-26) + +[Full Changelog](https://github.com/blackm0re/etoolkit/compare/2.0.0...2.1.0) + +**Changes:** + +- add encrypted values to *ETOOLKIT_SENSITIVE* implicitly + + ## [2.0.0](https://github.com/blackm0re/etoolkit/tree/2.0.0) (2024-05-13) [Full Changelog](https://github.com/blackm0re/etoolkit/compare/1.2.0...2.0.0) diff --git a/README.md b/README.md index 45c230a..b4f7efe 100644 --- a/README.md +++ b/README.md @@ -297,6 +297,10 @@ will prompt for the current master password, then for a new master password (with confirmation) and finally the new config file (if "all") or instance contents will be displayed. +The values of variables listed in *ETOOLKIT_SENSITIVE* will not be displayed +when an instance is loaded. The keys of encrypted values will be be added to +*ETOOLKIT_SENSITIVE* implicitly. + Contact the author for questions and suggestions! :) diff --git a/setup.cfg b/setup.cfg index 4985370..1838e18 100644 --- a/setup.cfg +++ b/setup.cfg @@ -15,12 +15,12 @@ classifiers = Intended Audience :: System Administrators License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+) Programming Language :: Python :: 3 - Programming Language :: Python :: 3.8 Programming Language :: Python :: 3.9 Programming Language :: Python :: 3.10 Programming Language :: Python :: 3.11 Programming Language :: Python :: 3.12 Programming Language :: Python :: 3.13 + Programming Language :: Python :: 3.14 Operating System :: POSIX Topic :: Security :: Cryptography @@ -32,7 +32,7 @@ project_urls = package_dir = = src packages = find: -python_requires = >=3.8 +python_requires = >=3.9 install_requires = cryptography>=3.2 diff --git a/src/etoolkit/__init__.py b/src/etoolkit/__init__.py index 711c6ae..4cf5d6e 100644 --- a/src/etoolkit/__init__.py +++ b/src/etoolkit/__init__.py @@ -18,7 +18,7 @@ from .etoolkit import EtoolkitInstance, EtoolkitInstanceError __author__ = 'Simeon Simeonov' -__version__ = '2.0.0' +__version__ = '2.1.0' __license__ = 'GPL3' diff --git a/src/etoolkit/etoolkit.py b/src/etoolkit/etoolkit.py index 9a1b47e..a933a01 100644 --- a/src/etoolkit/etoolkit.py +++ b/src/etoolkit/etoolkit.py @@ -43,6 +43,7 @@ class EtoolkitInstance: """ self._name = name self._parent = None + self._env = None self._raw_env_variables = {} self._sensitive_env_variables = [] self._master_password = None @@ -57,9 +58,6 @@ class EtoolkitInstance: self._instance_data['ETOOLKIT_PARENT'], data ) self._raw_env_variables.update(self._parent.raw_env_variables) - self._sensitive_env_variables.extend( - self._parent.sensitive_env_variables - ) if self._instance_data.get('ETOOLKIT_SENSITIVE'): if not isinstance(self._instance_data['ETOOLKIT_SENSITIVE'], list): raise EtoolkitInstanceError( @@ -399,6 +397,9 @@ class EtoolkitInstance: :return: New environment dict with all macros replaced by their values :rtype: dict """ + if self._env is not None: + return self._env + macros = { '%h': os.path.expanduser('~'), '%i': self.name, @@ -419,6 +420,8 @@ class EtoolkitInstance: ) if isinstance(value, str) and value.startswith('enc-val$'): value = self._decrypt_value(value) + if key not in self._sensitive_env_variables: + self._sensitive_env_variables.append(key) if isinstance(value, str) and value.endswith(':'): # if 'value' ends with ':', append the existing value of # os.environ[key] after the value of 'value' @@ -434,6 +437,15 @@ class EtoolkitInstance: else: # completely overwrite the existing value of os.environ[key] new_env[key] = self.parse_value(value, macros) + + # add the sensitive variables list of the parent (if any) + if self._parent is not None: + self._sensitive_env_variables.extend( + self._parent.sensitive_env_variables + ) + + self._env = new_env + return new_env def get_full_name(self, delimiter: str = '') -> str: diff --git a/tests/conftest.py b/tests/conftest.py index 37dd184..a4463fd 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -49,6 +49,11 @@ def config_data(): '+YYrZbwTBuG0Pl+WMQrvxLUtq5j8qYuQqz' 'oIwgoGt7AaWZCJz+E7qoDeg3wke70ST8U=' ), + 'ETOOLKIT_TEST_PASSWORD2': ( + 'enc-val$2$RCSZqq9pWrRDoCVYVHopyu1LzaJGfv8roVviqrLTBxM=$' + '+YYrZbwTBuG0Pl+WMQrvxLUtq5j8qYuQqz' + 'oIwgoGt7AaWZCJz+E7qoDeg3wke70ST8U=' + ), }, }, } diff --git a/tests/test_envtoolkit_instance.py b/tests/test_envtoolkit_instance.py index 9873d57..f555f81 100644 --- a/tests/test_envtoolkit_instance.py +++ b/tests/test_envtoolkit_instance.py @@ -31,7 +31,8 @@ def test_instantiation(config_data): instance = etoolkit.EtoolkitInstance('secret', config_data) assert 'ETOOLKIT_PARENT' not in instance.raw_env_variables assert 'ETOOLKIT_SENSITIVE' not in instance.raw_env_variables - assert 'DB_CONNECTION' not in instance.sensitive_env_variables + assert 'GNUPGHOME' not in instance.sensitive_env_variables + assert 'ETOOLKIT_TEST_PASSWORD2' not in instance.sensitive_env_variables assert 'ETOOLKIT_TEST_PASSWORD' in instance.sensitive_env_variables assert instance.name == 'secret' assert ( @@ -64,6 +65,7 @@ def test_get_environ( env = instance.get_environ() assert isinstance(env, dict) assert env['ETOOLKIT_TEST_PASSWORD'] == short_value + assert 'ETOOLKIT_TEST_PASSWORD2' in instance.sensitive_env_variables def test_get_full_name(config_data): -- cgit v1.3