config --help prints the internal staging hostname, so it ships in the public binary

Overview Files Skills Discover Packages Releases Dependencies Issues5 Breadcrumbs Pull Requests Activity

Closed general

Colby Knox · 1mo ago ·closed by Colby Knox

adom-wiki config --help prints the internal staging hostname to anyone who runs it. The CLI binary is downloadable anonymously, so an internal infrastructure hostname ships in a public artifact.

Source: a clap doc comment in src/commands/config_cmd.rs:

/// e.g. https://wiki.adom.inc or https://helium.stg.adom.internal

Reproduce against the release binary:

strings target/release/adom-wiki | grep -c 'adom\.internal'    # 1
adom-wiki config set-registry --help                            # prints it

Severity is low: the host does not resolve off the internal network, and it is an example rather than a default. But it is gratuitous, the fix is one line, and naming internal hosts in shipped artifacts is exactly the habit that produced the neighbouring leak in adom/adom-bridge#200 (a private per-user container host baked into a published binary).

Fix

Use a neutral placeholder in the help text: e.g. https://wiki.adom.inc or https://your-staging-host. Anyone who needs the real staging host already knows it.

Not affected

src/commands/discussion/mod.rs also contains the host, but in a #[cfg(test)] fixture, so it is not compiled into the release binary. Verified: the released binary contains exactly one occurrence, from the help text above.
No private *.adom.cloud container host appears in this binary or in the published adom/adom-wiki-cli tarball.

While filing this I also swept the current published tarball of adom/core, adom/adom-cli, adom/adom-lbr, adom/altium-bridge, adom/nameplate-generator, adom/mjpeg-stream-viewer, adom/adom-wiki-skillpack, adom/kicad-bridge and adom/hero-studio for both host classes. All clean.

Worth considering as the general fix for this whole class: a publish-time check that refuses an artifact containing *.adom.internal or a *-<id>.adom.cloud host. Proposed in adom/adom-bridge#200 as well.

1 Reply

Colby Knox · 1mo ago

Fixed in adom-wiki 1.7.52, released today with all five platforms.

config set-registry --help now reads e.g. https://wiki.adom.inc, or your own staging host. The internal hostname is gone from the shipped binary.
Verified on the release build: strings target/release/adom-wiki | grep -c 'adom\.internal' went from 1 to 0. The only other occurrence in the source is a #[cfg(test)] fixture, which was never compiled into the binary.
The backstop proposed here shipped in the same release: pkg lint now runs a PRIVATE_HOSTS pass that reads bytes and does not skip binaries, for both *-<id>.adom.cloud per-user container hosts and *.adom.internal hostnames. That is the gap that let a host compiled into a release binary reach an anonymously-downloadable tarball (adom/adom-bridge#200): the secret lint skipped binaries by design, so the author's source tree looked clean and the string was invisible.

Closing.