Add param to scope HTTPS credentials in netrc

[taylorsilva]

When using HTTPS credentials, the resource stores this in a .netrc file as the default login. That is done here:

git-resource/assets/common.sh

Lines 284 to 287 in bfc97e0

	if [ "$username" != "" -a "$password" != "" ]; then
	echo "default login $username password $password" >> "${HOME}/.netrc"
	fi
	}

This means the HTTPS credentials will be used for the git repository in source.uri and any HTTPs submodules in the repository as well, regardless of the domain. The default login in a netrc matches all hostnames.

This is fine for most cases but does expose a small security issue if someone is able to add a git submodule that points to an attacker controlled git server. That happening likely means the attacker has already stolen your credentials, making this whole thing slightly moot. There is a possible supply-chain attack vector here (a git submodule you add brings in another git submodule...), which is the only reason I feel this is worth bringing up.

Possible Solutions

• Change the default behaviour of the resource to try and parse the hostname from source.uri and scope the credentials in the .netrc to just that hostname. This would be a breaking change though for anyone that relies on the current behaviour, so I wouldn't take this route
• Add a new source param that takes a list of hostnames that the HTTPS credentials can be used for. Annoying that users have to configure another thing just to be secure, but is the safe, backwards-compatible option.