Restrict tableau_auth.json to 0600 on POSIX
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 72/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- python
- 领域
- authentication, cli, security
调研方向
Start at Session._save_file and inspect how ~/tableau_auth.json is written and updated. Verify fresh and repeated tabcmd login flows on POSIX, checking that stat -c '%a' reports 600; also exercise a chmod failure to confirm login still succeeds and the debug message is emitted.
由索引模型根据 Issue 内容生成。
描述
Problem
~/tableau_auth.json is written by Session._save_file with the process umask (typically 0022 on Linux/macOS), leaving it world-readable. The file holds a valid Tableau auth_token plus site_id, user_id, server_url, and optionally a personal_access_token value; anyone with local read on the user's home dir can impersonate them until the token expires.
Historically this was largely dead weight because tabcmd 2 did not reuse the saved token (see #463). Now that #463 makes the token load-bearing across invocations, restricting the file's permissions is worth doing.
Proposed minimal fix (POSIX only)
In Session._save_file, after json.dump(...), call os.chmod(file_path, 0o600) on POSIX. Log a debug (not warning) line if chmod raises, since the write itself already succeeded and losing the tightening is not fatal.
def _save_file(self, data: Dict[str, Any]) -> None:
file_path = self._get_file_path()
with open(str(file_path), "w") as f:
json.dump(data, f)
if os.name == "posix":
try:
os.chmod(file_path, 0o600)
except OSError as e:
self.logger.debug(
"Could not restrict {} to 0600 ({})".format(file_path, type(e).__name__)
)
Explicitly out of scope for this issue
- Windows ACLs. The default ACL on
%USERPROFILE%already restricts to the current user; a Windows-specific ACL step needs pywin32 wiring, a Windows-only test fixture, and belongs in a separate change. - OS keyring migration. Storing the token in Windows Credential Manager / macOS Keychain / Secret Service is the right long-term direction but is a larger change that deserves its own design and migration path.
Verification
Author does not currently have a POSIX dev environment for this fix; testing on at least one Linux distribution before merge is a hard requirement. Suggested pre-merge checks:
- Fresh
tabcmd login, thenstat -c '%a' ~/tableau_auth.jsonreports600. - Update flow: overwrite existing file, permissions remain
600. - Chmod failure path: mount the home dir read-only or run under a filesystem that refuses chmod; confirm login still succeeds and the debug line fires.
Related
- #463 — the fix that made saved-token reuse actually load-bearing.
- 主要语言
- Python
- 星标
- 52
- 派生
- 17
- 平均合并
- 5 天 20 小时
- 30 天内合并 PR
- 2
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
tableau/tabcmd 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 82/100
-
难度 2/5 1-3 小时 新手友好度 84/100
-
feat: publish missing --description flag from tabcmd Classic可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
-
feat: creategroup missing --role flag from tabcmd Classic可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
-
bug
难度 2/5 1-3 小时 新手友好度 68/100
相似的 Issue
-
难度 1/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 85/100
tharje/spooler-v2#20 ·
-
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复
-
Bump version of azure-servicebus可能已有人在做 @joostlek 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 68/100
home-assistant/core#186275 ·
维护者通常 1 天内回复
-
documentation
难度 1/5 1 小时以内 新手友好度 72/100