CVE-2024-35183: Insufficient Information (NVD-CWE-noinfo)
value: wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub token to be sent to remote servers other than `github.com`. Most git-dependent functionality in wolfictl relies on its own `git` package, which contains centralized logic for implementing interactions with git repositories. Some of this functionality requires authentication in order to access private repositories. A central function `GetGitAuth` looks for a GitHub token in the environment variable `GITHUB_TOKEN` and returns it as an HTTP basic auth object to be used with the `github.com/go-git/go-git/v5` library. Most callers (direct or indirect) of `GetGitAuth` use the token to authenticate to github.com only; however, in some cases callers were passing this authentication without checking that the remote git repository was hosted on github.com. This behavior has existed in one form or another since commit 0d06e1578300327c212dda26a5ab31d09352b9d0 - committed January 25, 2023. This impacts anyone who ran the `wolfictl check update` commands with a Melange configuration that included a `git-checkout` directive step that referenced a git repository not hosted on github.com. This also impacts anyone who ran `wolfictl update <url>` with a remote URL outside of github.com. Additionally, these subcommands must have run with the `GITHUB_TOKEN` environment variable set to a valid GitHub token. Users should upgrade to version 0.16.10 to receive a patch.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-15T22:15Z
Repository: https://github.com/wolfi-dev/wolfictl
Language: Go
Files changed: pkg/git/submodules/update.go, pkg/git/submodules/update_test.go, pkg/update/update.go
Commit date: 2023-01-25 13:49:36 +0000
Commit message: wolfictl update: use git auth when cloning melange config repo

Signed-off-by: James Rawlings <jrawlings@chainguard.dev>

Diff: diff --git a/pkg/git/submodules/testdata/.gitmodules b/pkg/git/submodules/testdata/multiple_submodules/.gitmodules
similarity index 100%
rename from pkg/git/submodules/testdata/.gitmodules
rename to pkg/git/submodules/testdata/multiple_submodules/.gitmodules
diff --git a/pkg/git/submodules/update.go b/pkg/git/submodules/update.go
index b041080..27caa2a 100644
--- a/pkg/git/submodules/update.go
+++ b/pkg/git/submodules/update.go
@@ -13,11 +13,11 @@ import (
 
 // Update will modify a .gitmodules file and perform a `git submodule update --remote`
 func Update(dir, owner, repo, version string, wt *git.Worktree) error {
 
 	// update the .gitmodule config file
-	submodules, err := updateConfigfile(dir, owner, repo, version)
+	submodules, err := updateConfigFile(dir, owner, repo, version)
 	if err != nil {
 		return errors.Wrap(err, "failed to update gitmodules file")
 	}
 
 	// git submodule update --remote
@@ -28,11 +28,11 @@ func Update(dir, owner, repo, version string, wt *git.Worktree) error {
 		}
 	}
 	return nil
 }
 
-func updateConfigfile(dir, owner, repo, version string) ([]string, error) {
+func updateConfigFile(dir, owner, repo, version string) ([]string, error) {
 	var submodules []string
 	filename := filepath.Join(dir, ".gitmodules")
 	data, err := os.ReadFile(filename)
 
 	if err != nil {
diff --git a/pkg/git/submodules/update_test.go b/pkg/git/submodules/update_test.go
index df78aa2..53f5d5f 100644
--- a/pkg/git/submodules/update_test.go
+++ b/pkg/git/submodules/update_test.go
@@ -8,21 +8,21 @@ import (
 	"github.com/go-git/go-git/v5/config"
 
 	"github.com/stretchr/testify/assert"
 )
 
-func TestSubmodules_update(t *testing.T) {
+func TestSubmodules_updateConfigFile(t *testing.T) {
 
 	dir := t.TempDir()
 
-	data, err := os.ReadFile(filepath.Join("testdata", ".gitmodules"))
+	data, err := os.ReadFile(filepath.Join("testdata", "multiple_submodules", ".gitmodules"))
 	assert.NoError(t, err)
 
 	err = os.WriteFile(filepath.Join(dir, ".gitmodules"), data, 0666)
 	assert.NoError(t, err)
 
-	_, err = updateConfigfile(dir, "foo", "bar", "v1.2.4")
+	_, err = updateConfigFile(dir, "foo", "bar", "v1.2.4")
 	assert.NoError(t, err)
 
 	data, err = os.ReadFile(filepath.Join(dir, ".gitmodules"))
 	assert.NoError(t, err)
 
diff --git a/pkg/update/update.go b/pkg/update/update.go
index b69393f..e977cdf 100644
--- a/pkg/update/update.go
+++ b/pkg/update/update.go
@@ -102,14 +102,23 @@ func (o *Options) Update() error {
 		o.Logger.Printf("using working directory %s", tempDir)
 	} else {
 		defer os.Remove(tempDir)
 	}
 
-	repo, err := git.PlainClone(tempDir, false, &git.CloneOptions{
+	cloneOpts := &git.CloneOptions{
 		URL:      o.RepoURI,
 		Progress: os.Stdout,
-	})
+	}
+	gitToken := os.Getenv("GITHUB_TOKEN")
+	if gitToken != "" {
+		cloneOpts.Auth = &gitHttp.BasicAuth{
+			Username: "abc123",
+			Password: gitToken,
+		}
+	}
+
+	repo, err := git.PlainClone(tempDir, false, cloneOpts)
 	if err != nil {
 		return fmt.Errorf("failed to clone repository %s into %s: %w", o.RepoURI, tempDir, err)
 	}
 
 	// first, let's get the melange package(s) from the target git repo, that we want to check for updates

Vulnerable code: 	submodules, err := updateConfigfile(dir, owner, repo, version)
func updateConfigfile(dir, owner, repo, version string) ([]string, error) {
func TestSubmodules_update(t *testing.T) {
	data, err := os.ReadFile(filepath.Join("testdata", ".gitmodules"))
	_, err = updateConfigfile(dir, "foo", "bar", "v1.2.4")
	repo, err := git.PlainClone(tempDir, false, &git.CloneOptions{
	})
Fixed code: 	submodules, err := updateConfigFile(dir, owner, repo, version)
func updateConfigFile(dir, owner, repo, version string) ([]string, error) {
func TestSubmodules_updateConfigFile(t *testing.T) {
	data, err := os.ReadFile(filepath.Join("testdata", "multiple_submodules", ".gitmodules"))
	_, err = updateConfigFile(dir, "foo", "bar", "v1.2.4")
	cloneOpts := &git.CloneOptions{
	}
	gitToken := os.Getenv("GITHUB_TOKEN")
	if gitToken != "" {
		cloneOpts.Auth = &gitHttp.BasicAuth{
			Username: "abc123",
			Password: gitToken,
		}
	}

	repo, err := git.PlainClone(tempDir, false, cloneOpts)