check for Cipher/Decipher before using them, and warn if not available

1 files changed, 49 insertions, 0 deletions

diff --git a/lib/utils/ini.js b/lib/utils/ini.js
index 5e132f6f5..8e3b0608e 100644
--- a/lib/utils/ini.js
+++ b/lib/utils/ini.js
@@ -10,7 +10,24 @@ var fs = require('fs')
   , http = require('http')
   , log = require("./log")
   , ini = require("ini")
+  , crypto = require("crypto")
 
+// if installed, use rhys' package explicitly
+if (typeof crypto.Cipher !== "function") {
+  try {
+    crypto = require("crypto-0.0.5")
+  } catch (ex) {}
+}
+if (typeof crypto.Cipher !== "function") {
+  sys.error( "*" )
+  sys.error( "* Warning: Cipher unavailable in this nodejs version ("
+           + process.version + ")")
+  sys.error( "* Username/password stored in the clear" )
+  sys.error( "*" )
+  return
+}
+
+var sys = require("sys")
   , defaultConfig  =
     { 'auto-activate' : true
     , root : path.join(process.env.HOME, '.node_libraries')
@@ -18,6 +35,7 @@ var fs = require('fs')
     }
   , configfile = path.join(process.env.HOME, '.npmrc')
   , config = getConfig()
+  , privateKey
 
 exports.config = config
 exports.save = save
@@ -45,10 +63,41 @@ function getConfig () {
       config[c] = defaultConfig[c]
     }
   }
+  decryptAuth(config)
   return config
 }
 
+function getKey () {
+  if (privateKey) return privateKey
+  var ssh = path.join(process.env.HOME, ".ssh")
+    , keys = [ path.join(ssh, "id_dsa")
+             , path.join(ssh, "id_rsa")
+             , path.join(ssh, "identity")
+             ]
+  for (var i = 0, l = keys.length; i < l; i ++) {
+    try {
+      return (privateKey = fs.readFileSync(keys[i]))
+    } catch (e) {}
+  }
+  throw new Error("No private key found.")
+}
+function encryptAuth (config) {
+  if (!config.auth || !crypto.Cipher) return
+  var c = (new crypto.Cipher).init("aes192", getKey())
+  config.authCrypt = c.update(config.auth, "utf8", "hex")
+  config.authCrypt += c.final("hex")
+  delete config.auth
+}
+function decryptAuth (config) {
+  if (!config.authCrypt || !crypto.Decipher) return
+  var c = (new crypto.Decipher).init("aes192", getKey())
+  config.auth = c.update(config.authCrypt, "hex", "utf8")
+  config.auth += c.final("utf8")
+  delete config.authCrypt
+}
+
 function save (cb) {
+  encryptAuth(config)
   fs[
     cb ? "writeFile" : "writeFileSync"
   ](configfile, ini.stringify({"-":config}), "utf8", cb)