fix: api keys are passed as command-line arguments w... in...

[anupamme]

Summary

Fix critical severity security issue in content-read-settings.js.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	content-read-settings.js:10
Assessment	Likely exploitable

Description: API keys are passed as command-line arguments which can be exposed via process listing commands (ps aux) on the host system, allowing attackers to read administrative credentials in clear text.

Evidence

Exploitation scenario: An attacker with access to the host system (local user or compromised application) can run 'ps aux | grep node' or examine /proc/[pid]/cmdline to view the command-line arguments containing the Ghost.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• content-read-settings.js

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 68d47377-b93d-4fbf-8123-1da1ce0ad67f

📥 Commits

Reviewing files that changed from the base of the PR and between 944489e and f0ad906.

📒 Files selected for processing (1)

• content-read-settings.js

🚧 Files skipped from review as they are similar to previous changes (1)

• content-read-settings.js

---

Walkthrough

content-read-settings.js now accepts only the Ghost URL as a command-line argument. It reads GHOST_CONTENT_API_KEY from the environment, exits with an error when the variable is absent, and uses the validated key to construct the Ghost Content API client.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title points to the API keys being moved off the command line, which matches the main security fix.
Description check	✅ Passed	The description accurately summarizes the security fix and the file changed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@content-read-settings.js`:
- Around line 10-13: Update the argument validation around process.argv to
require exactly one user-supplied argument, rejecting both missing and extra
arguments with the existing error-and-exit behavior. Preserve the valid
single-argument execution path and ensure invocations such as a URL plus API key
fail before processing.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9a7c142d-c5e0-4f28-b302-78471480e6ae

📥 Commits

Reviewing files that changed from the base of the PR and between 2b1b6e9 and 944489e.

📒 Files selected for processing (1)

• content-read-settings.js

[anupamme]

✅ Review Feedback Addressed

I've automatically addressed 2 review comment(s):

The code review flagged that checking process.argv.length < 3 still allows extra arguments — meaning someone could still run the old insecure form node content-read-settings.js <url> <api-key> without any error. Changing the check to process.argv.length !== 3 enforces that exactly one user-supplied argument (the URL) is accepted, and rejects any invocation with extra arguments with a clear error message. This closes the loophole where an API key could still be passed on the command line and exposed via ps aux.

Files modified:

• content-read-settings.js

The changes have been pushed to this PR branch. Please review!