@azure/identity - npm Package Compare versions

Comparing version 1.0.3-dev.20200305.1 to 1.1.0-dev.20200310.1

dist-esm/src/credentials/azureCliCredential.js

@@ -9,2 +9,13 @@ // Copyright (c) Microsoft Corporation.
 import * as child_process from "child_process";
+function getSafeWorkingDir() {
+    if (process.platform === "win32") {
+        if (!process.env.SystemRoot) {
+            throw new Error("Azure CLI credential expects a 'SystemRoot' environment variable");
+        }
+        return process.env.SystemRoot;
+    }
+    else {
+        return "/bin";
+    }
+}
 /**
@@ -27,3 +38,3 @@ * Provides the user access token and expire time
                 try {
-                    child_process.exec(`az account get-access-token --output json --resource ${resource}`, (error, stdout, stderr) => {
+                    child_process.exec(`az account get-access-token --output json --resource ${resource}`, { cwd: getSafeWorkingDir() }, (error, stdout, stderr) => {
                         resolve({ stdout: stdout, stderr: stderr });
@@ -55,2 +66,6 @@ });
                 const resource = scope.replace(/\/.default$/, "");
+                // Check to make sure the scope we get back is a valid scope
+                if (!scope.match(/^[0-9a-zA-Z-.:/]+$/)) {
+                    throw new Error("Invalid scope was specified by the user or calling client");
+                }
                 let responseData = "";
@@ -57,0 +72,0 @@ const { span } = createSpan("AzureCliCredential-getToken", options);

dist-esm/src/index.js

@@ -6,3 +6,2 @@ // Copyright (c) Microsoft Corporation.
 export { EnvironmentCredential } from "./credentials/environmentCredential";
-export { AzureCliCredential } from "./credentials/azureCliCredential";
 export { ClientSecretCredential } from "./credentials/clientSecretCredential";
@@ -9,0 +8,0 @@ export { ClientCertificateCredential } from "./credentials/clientCertificateCredential";

dist/index.js

@@ -938,2 +938,13 @@ 'use strict';
 // Copyright (c) Microsoft Corporation.
+function getSafeWorkingDir() {
+    if (process.platform === "win32") {
+        if (!process.env.SystemRoot) {
+            throw new Error("Azure CLI credential expects a 'SystemRoot' environment variable");
+        }
+        return process.env.SystemRoot;
+    }
+    else {
+        return "/bin";
+    }
+}
 /**
@@ -956,3 +967,3 @@ * Provides the user access token and expire time
                 try {
-                    child_process.exec(`az account get-access-token --output json --resource ${resource}`, (error, stdout, stderr) => {
+                    child_process.exec(`az account get-access-token --output json --resource ${resource}`, { cwd: getSafeWorkingDir() }, (error, stdout, stderr) => {
                         resolve({ stdout: stdout, stderr: stderr });
@@ -984,2 +995,6 @@ });
                 const resource = scope.replace(/\/.default$/, "");
+                // Check to make sure the scope we get back is a valid scope
+                if (!scope.match(/^[0-9a-zA-Z-.:/]+$/)) {
+                    throw new Error("Invalid scope was specified by the user or calling client");
+                }
                 let responseData = "";
@@ -1392,3 +1407,2 @@ const { span } = createSpan("AzureCliCredential-getToken", options);
 exports.AuthorizationCodeCredential = AuthorizationCodeCredential;
-exports.AzureCliCredential = AzureCliCredential;
 exports.ChainedTokenCredential = ChainedTokenCredential;
@@ -1395,0 +1409,0 @@ exports.ClientCertificateCredential = ClientCertificateCredential;

package.json

 {
   "name": "@azure/identity",
   "sdk-type": "client",
-  "version": "1.0.3-dev.20200305.1",
+  "version": "1.1.0-dev.20200310.1",
   "description": "Provides credential implementations for Azure SDK libraries that can authenticate with Azure Active Directory",
@@ -6,0 +6,0 @@ "main": "dist/index.js",

README.md

@@ -104,3 +104,3 @@ ## Azure Identity client library for JavaScript
 
-The `AuthorizationCodeCredential` takes more up-front work to use than the other credential types at this time. A full sample demonstrating how to use this credential can be found in [`samples/authorizationCodeSample.ts`](https://github.com/Azure/azure-sdk-for-js/tree/c5dcaee11c2c31cdb69722c2b0c1d46b2205d516/sdk/identity/identity/samples/authorizationCodeSample.ts).
+The `AuthorizationCodeCredential` takes more up-front work to use than the other credential types at this time. A full sample demonstrating how to use this credential can be found in [`samples/authorizationCodeSample.ts`](https://github.com/Azure/azure-sdk-for-js/tree/2ae61c9c1f91f5fc3be0a3340ac4b87a294bdabe/sdk/identity/identity/samples/authorizationCodeSample.ts).
 
@@ -149,3 +149,3 @@ ### Chaining credentials
 
-If you'd like to contribute to this library, please read the [contributing guide](https://github.com/Azure/azure-sdk-for-js/tree/c5dcaee11c2c31cdb69722c2b0c1d46b2205d516/CONTRIBUTING.md) to learn more about how to build and test the code.
+If you'd like to contribute to this library, please read the [contributing guide](https://github.com/Azure/azure-sdk-for-js/tree/2ae61c9c1f91f5fc3be0a3340ac4b87a294bdabe/CONTRIBUTING.md) to learn more about how to build and test the code.
 
@@ -152,0 +152,0 @@ This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).

src/credentials/azureCliCredential.ts

@@ -12,2 +12,13 @@ // Copyright (c) Microsoft Corporation.
 
+function getSafeWorkingDir(): string {
+    if (process.platform === "win32") {
+      if (!process.env.SystemRoot) {
+        throw new Error("Azure CLI credential expects a 'SystemRoot' environment variable");
+      }
+      return process.env.SystemRoot;
+    } else {
+      return "/bin";
+    }
+}
+
 /**
@@ -32,2 +43,3 @@ * Provides the user access token and expire time
           `az account get-access-token --output json --resource ${resource}`,
+          {cwd: getSafeWorkingDir()},
           (error, stdout, stderr) => {
@@ -62,2 +74,8 @@ resolve({ stdout: stdout, stderr: stderr });
       const resource = scope.replace(/\/.default$/, "");
+
+      // Check to make sure the scope we get back is a valid scope
+      if (!scope.match(/^[0-9a-zA-Z-.:/]+$/)) {
+        throw new Error("Invalid scope was specified by the user or calling client")
+      }
+
       let responseData = "";
@@ -64,0 +82,0 @@

src/index.ts

@@ -10,3 +10,2 @@ // Copyright (c) Microsoft Corporation.
 export { EnvironmentCredential } from "./credentials/environmentCredential";
-export { AzureCliCredential } from "./credentials/azureCliCredential";
 export { ClientSecretCredential } from "./credentials/clientSecretCredential";
@@ -13,0 +12,0 @@ export { ClientCertificateCredential } from "./credentials/clientCertificateCredential";

types/identity.d.ts

@@ -121,29 +121,2 @@ import { AccessToken } from '@azure/core-http';
 /**
- * Provides the user access token and expire time
- * with Azure CLI command "az account get-access-token".
- */
-export declare class AzureCliCredential implements TokenCredential {
-    /**
-     * Creates an instance of the AzureCliCredential class.
-     */
-    constructor();
-    /**
-     * Gets the access token from Azure CLI
-     * @param resource The resource to use when getting the token
-     */
-    protected getAzureCliAccessToken(resource: string): Promise<unknown>;
-    /**
-     * Authenticates with Azure Active Directory and returns an access token if
-     * successful.  If authentication cannot be performed at this time, this method may
-     * return null.  If an error occurs during authentication, an {@link AuthenticationError}
-     * containing failure details will be thrown.
-     *
-     * @param scopes The list of scopes for which the token will have access.
-     * @param options The options used to configure any requests this
-     *                TokenCredential implementation might make.
-     */
-    getToken(scopes: string | string[], options?: GetTokenOptions): Promise<AccessToken | null>;
-}
-
-/**
  * The "login style" to use in the authentication flow:
@@ -150,0 +123,0 @@ * - "redirect" redirects the user to the authentication page and then

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

422703

increased by0.38%

Lines of code

5879

increased by0.27%

Worsened metrics

Number of low supply chain risk alerts

31

increased by14.81%

No dependency changes