mattcasters opened a new issue, #8410: URL: https://github.com/apache/hop/issues/8410
### What needs to happen? #8398 stops `EnvironmentApplier` from copying stored hop-config username/password onto a project-chosen repository URL. That is the leak in #8393. A narrower path of the same class remains. Unmatched spec URLs opt out of the global `HOP_MARKETPLACE_USERNAME` / `HOP_MARKETPLACE_PASSWORD` pair, but repository-scoped `HOP_MARKETPLACE_<ID>_*` variables still apply, and the spec chooses `id`. A `hop-env.yaml` with `id: nexus` (or any other configured id) and `url: https://evil.example/` therefore still sends `HOP_MARKETPLACE_NEXUS_PASSWORD` to a host the operator never configured. That is the credential source the docs recommend when more than one private repository is configured. Host matching cannot save it: `configuredCredentialSource` only copies stored fields; scoped lookup happens later in `effectiveUsername` / `effectivePassword` using the spec id. `RepositoryOriginTest.globalEnvironmentCredentialsCanBeSuppressedWhileScopedOnesStillApply` currently locks the leftover in. For a spec repository with no origin match, do not apply scoped env vars whose prefix is already a hop-config repository id (or, stricter, do not apply scoped env vars at all unless origin matches that id’s configured URL). Keep `HOP_MARKETPLACE_<ID>_*` as the way to credential a *new* spec id. Add an apply/HTTP test: configured id `nexus` with scoped env secrets, spec `id: nexus` on a different host, assert no `Authorization` header. ## Compatibility leftover (same PR, not a leak) `configuredCredentialSource` skips every hop-config repository whose stored `username` and `password` are blank, even when `sameOriginAs(url)` would be true. A spec that names a second path on the operator’s host is then treated as unmatched, so `globalEnvironmentCredentials` is set false. Operators who put secrets only in `HOP_MARKETPLACE_USERNAME` / `_PASSWORD` therefore do not reuse those credentials on the same scheme/host/port. Decide origin match independently of whether stored fields are populated. On a match, keep `globalEnvironmentCredentials` true and inherit that configured repo’s *effective* credentials (stored fields and its own scoped env). This is fail-closed, not a new leak. ## Scope This is the leftover from #8398 / #8393. It still does not stop a project pointing the plugin supply chain at a repository of its choosing — that remains the separate operator-confirmation question from #8393. ## Compatibility Projects that credential a *new* spec id with `HOP_MARKETPLACE_<NEW_ID>_*` keep working. Reusing an existing configured id on a different host must no longer send that id’s secrets. ### Issue Priority Priority: 2 ### Issue Component Component: Marketplace -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
