github oauth: too much of requested permissions

[mike-goodwin]

github oauth: too much of requested permissions

[StephenOTT]

+1 on this. WAYYY to much access is being requested

[whereswaldon]

I think getting a read-write deploy key for the repo would be sufficient. That would only allow access to repo files, but not any of the settings/metatdata/issues/etc.

[mike-goodwin]

Thanks for your interest in Threat Dragon. I know what you mean about the scope. The problem is that the app wants to write to the repo to store the model files and GitHub scopes don't allow anything less than repo access as far as I can see. With the empty scope it would be able to read models but not save them.

The only other way I can think of to make this work is to use git to push the model files from my server to GitHub instead of using the GitHub API. The problem is, this would mean storing and handling your GH creds, which is worse than the repo scope IMO.

Or, maybe I could do git from the browser using a javascript git implementation. That way your creds would never need to leave the browser...

This was one of the main reasons for creating the desktop variant. Would that be of interest?

Any suggestions on the way forward would be very welcome.

[jgadsden]

This is linked to a similar issue #148 , because of the scopes available in github this has become a documentation issue

[jgadsden]

Migrated to new issue in the OWASP area repo : OWASP/threat-dragon#5