Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Security/Bug: Go server leaks auth_token to ps and leaves zombie processes

オープン
  • 何か問題がありますか？
#583 コメント 2 件 リアクション 0 件 担当者 1 名 GitHub で見る

@jakubbortlik がすでに取り組んでいます。

2026年9月22日 から。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
46/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
静か
技術スタック
gitlab, go, lua, neovim
領域
security, tooling

調査の方向性

:h gitlab.nvim.troubleshooting から始め、次に vim.system() によるサーバー起動、Go の設定処理、VimLeavePre のライフサイクル処理を特定します。レポートにはソースファイルやテストの名前がなく、再現手順も不完全です。認証がトークンをプロセス引数に公開せずに引き続き機能し、報告されている高速終了や強制終了を含め、Neovim の終了後にサーバープロセスが残らなければ完了です。

索引モデルが issue の本文から書いたものです。

説明

Prerequsities

  • I'm on the latest version of the plugin
  • I've installed the required dependencies
  • I've run :h gitlab.nvim.troubleshooting and followed the steps there

Setup Configuration and Environment

NVIM v0.12.4
Build type: Release
LuaJIT 2.1.1784580905
Vim versions: 8.1, 8.2, 9.0, 9.1, 9.2

system vimrc file: "$VIM/sysinit.vim"
fall-back for $VIM: "/usr/local/Cellar/neovim/0.12.4/share/nvim"

Bug Description

Currently, gitlab.nvim passes its configuration JSON (which contains the auth_token) directly
to the Go server binary via a command-line argument when calling vim.system().

Because command-line arguments are globally visible on UNIX systems via ps or pgrep, any user
on the machine can easily read the GitLab API token just by listing running processes.

Additionally, if Neovim is closed forcefully or quickly (e.g. via scripts or aliases), the Go
server processes aren't killed and become orphaned zombies running in the background. Because
they pile up, it becomes very easy to accidentally spot the leaked token in pgrep -fl nvim outputs.

Reproduction Steps

  1. Check out the feature branch
  2. Open Neovim
  3. ...

Screenshots

➜ pgrep -fl nvim
2080 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"gitlab_url":"https://xxxxxxxxxxxxxxx.com","connection_settings":{"insecure":false,"proxy":"","remote":"origin"},"debug":{"response":false,"request":false,"gitlab_request":false,"gitlab_response":false},"port":54232,"chosen_mr_iid":0,"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","auth_token":"xxxxxxxxxxxxxxxxx"}
21519 nvim . .
21544 nvim --embed . .
66859 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"chosen_mr_iid":4143,"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","auth_token":"xxxxxxxxxxxxxxxxx","gitlab_url":"https://xxxxxxxxxxxxxxx.com","debug":{"request":false,"gitlab_request":false,"gitlab_response":false,"response":false},"connection_settings":{"proxy":"","remote":"origin","insecure":false},"port":51887}
83060 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"debug":{"gitlab_request":false,"gitlab_response":false,"response":false,"request":false},"connection_settings":{"remote":"origin","proxy":"","insecure":false},"port":0,"chosen_mr_iid":0,"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","auth_token":"xxxxxxxxxxxxxxxxx","gitlab_url":"https://xxxxxxxxxxxxxxx.com"}
84503 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"debug":{"gitlab_request":false,"gitlab_response":false,"response":false,"request":false},"connection_settings":{"remote":"origin","proxy":"","insecure":false},"port":0,"chosen_mr_iid":0,"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","auth_token":"xxxxxxxxxxxxxxxxx","gitlab_url":"https://xxxxxxxxxxxxxxx.com"}
91585 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","port":0,"gitlab_url":"https://xxxxxxxxxxxxxxx.com","debug":{"request":false,"gitlab_request":false,"gitlab_response":false,"response":false},"connection_settings":{"insecure":false,"proxy":"","remote":"origin"},"auth_token":"xxxxxxxxxxxxxxxxx","chosen_mr_iid":0}
95389 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"chosen_mr_iid":0,"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","auth_token":"xxxxxxxxxxxxxxxxx","debug":{"gitlab_response":false,"response":false,"request":false,"gitlab_request":false},"gitlab_url":"https://xxxxxxxxxxxxxxx.com","connection_settings":{"proxy":"","insecure":false,"remote":"origin"},"port":0}
97335 /Users/xxxxxxx/.local/share/nvim/gitlab.nvim/bin/server {"debug":{"response":false,"request":false,"gitlab_request":false,"gitlab_response":false},"chosen_mr_iid":0,"log_path":"/Users/xxxxxxx/.cache/nvim/gitlab.nvim.log","auth_token":"xxxxxxxxxxxxxxxxx","gitlab_url":"https://xxxxxxxxxxxxxxx.com","connection_settings":{"insecure":false,"remote":"origin","proxy":""},"port":0}

Suggested Fix

The configuration JSON (or at least the auth_token) should be passed to the Go server via stdin
or as an environment variable, rather than as a command-line argument. Additionally, it would
be great if the plugin ensured the server process is killed properly upon VimLeavePre.

主要言語
Lua
スター
401
フォーク
64
平均マージ
7時間 17分
マージ済み PR（30日）
4

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

harrisoncramer/gitlab.nvim のほかの issue

harrisoncramer/gitlab.nvim の issue をすべて見る

似ている issue

Lua の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。