From 97f7855de3d963cf0f58d38be165a9eed1c19064 Mon Sep 17 00:00:00 2001
From: Andreas Oberritter <obi@saftware.de>
Date: Sun, 30 Aug 2020 23:20:57 +0200
Subject: [PATCH] Add new option --repository-file (default:
 $RESTIC_REPOSITORY_FILE)

As an alternative to -r, this allows to read the repository URL
from a file in order to prevent certain types of information leaks,
especially for URLs containing credentials.

Fixes #1458, fixes #2900.
---
 changelog/unreleased/pull-2910 | 10 ++++++++++
 cmd/restic/cmd_init.go         |  7 ++++++-
 cmd/restic/global.go           | 34 +++++++++++++++++++++++++++++++---
 doc/040_backup.rst             |  1 +
 4 files changed, 48 insertions(+), 4 deletions(-)
 create mode 100644 changelog/unreleased/pull-2910

diff --git a/changelog/unreleased/pull-2910 b/changelog/unreleased/pull-2910
new file mode 100644
index 000000000..0a760e47b
--- /dev/null
+++ b/changelog/unreleased/pull-2910
@@ -0,0 +1,10 @@
+Enhancement: New option --repository-file
+
+We've added a new command-line option --repository-file as an alternative
+to -r. This allows to read the repository URL from a file in order to
+prevent certain types of information leaks, especially for URLs containing
+credentials.
+
+https://github.com/restic/restic/issues/1458
+https://github.com/restic/restic/issues/2900
+https://github.com/restic/restic/pull/2910
diff --git a/cmd/restic/cmd_init.go b/cmd/restic/cmd_init.go
index ae831c4e3..62c0b35ec 100644
--- a/cmd/restic/cmd_init.go
+++ b/cmd/restic/cmd_init.go
@@ -52,7 +52,12 @@ func runInit(opts InitOptions, gopts GlobalOptions, args []string) error {
 		return err
 	}
 
-	be, err := create(gopts.Repo, gopts.extended)
+	repo, err := ReadRepo(gopts)
+	if err != nil {
+		return err
+	}
+
+	be, err := create(repo, gopts.extended)
 	if err != nil {
 		return errors.Fatalf("create repository at %s failed: %v\n", location.StripPassword(gopts.Repo), err)
 	}
diff --git a/cmd/restic/global.go b/cmd/restic/global.go
index e3356cc73..58a43ff4e 100644
--- a/cmd/restic/global.go
+++ b/cmd/restic/global.go
@@ -49,6 +49,7 @@ type backendWrapper func(r restic.Backend) (restic.Backend, error)
 // GlobalOptions hold all global options for restic.
 type GlobalOptions struct {
 	Repo            string
+	RepositoryFile  string
 	PasswordFile    string
 	PasswordCommand string
 	KeyHint         string
@@ -101,6 +102,7 @@ func init() {
 
 	f := cmdRoot.PersistentFlags()
 	f.StringVarP(&globalOptions.Repo, "repo", "r", os.Getenv("RESTIC_REPOSITORY"), "`repository` to backup to or restore from (default: $RESTIC_REPOSITORY)")
+	f.StringVarP(&globalOptions.RepositoryFile, "repository-file", "", os.Getenv("RESTIC_REPOSITORY_FILE"), "`file` to read the repository location from (default: $RESTIC_REPOSITORY_FILE)")
 	f.StringVarP(&globalOptions.PasswordFile, "password-file", "p", os.Getenv("RESTIC_PASSWORD_FILE"), "`file` to read the repository password from (default: $RESTIC_PASSWORD_FILE)")
 	f.StringVarP(&globalOptions.KeyHint, "key-hint", "", os.Getenv("RESTIC_KEY_HINT"), "`key` ID of key to try decrypting first (default: $RESTIC_KEY_HINT)")
 	f.StringVarP(&globalOptions.PasswordCommand, "password-command", "", os.Getenv("RESTIC_PASSWORD_COMMAND"), "shell `command` to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)")
@@ -382,15 +384,41 @@ func ReadPasswordTwice(gopts GlobalOptions, prompt1, prompt2 string) (string, er
 	return pw1, nil
 }
 
+func ReadRepo(opts GlobalOptions) (string, error) {
+	if opts.Repo == "" && opts.RepositoryFile == "" {
+		return "", errors.Fatal("Please specify repository location (-r or --repository-file)")
+	}
+
+	repo := opts.Repo
+	if opts.RepositoryFile != "" {
+		if repo != "" {
+			return "", errors.Fatal("Options -r and --repository-file are mutually exclusive, please specify only one")
+		}
+
+		s, err := textfile.Read(opts.RepositoryFile)
+		if os.IsNotExist(errors.Cause(err)) {
+			return "", errors.Fatalf("%s does not exist", opts.RepositoryFile)
+		}
+		if err != nil {
+			return "", err
+		}
+
+		repo = strings.TrimSpace(string(s))
+	}
+
+	return repo, nil
+}
+
 const maxKeys = 20
 
 // OpenRepository reads the password and opens the repository.
 func OpenRepository(opts GlobalOptions) (*repository.Repository, error) {
-	if opts.Repo == "" {
-		return nil, errors.Fatal("Please specify repository location (-r)")
+	repo, err := ReadRepo(opts)
+	if err != nil {
+		return nil, err
 	}
 
-	be, err := open(opts.Repo, opts, opts.extended)
+	be, err := open(repo, opts, opts.extended)
 	if err != nil {
 		return nil, err
 	}
diff --git a/doc/040_backup.rst b/doc/040_backup.rst
index 274949010..3c0152569 100644
--- a/doc/040_backup.rst
+++ b/doc/040_backup.rst
@@ -407,6 +407,7 @@ environment variables. The following lists these environment variables:
 
 .. code-block:: console
 
+    RESTIC_REPOSITORY_FILE              Name of a file containing the location of the repository (replaces --repository-file)
     RESTIC_REPOSITORY                   Location of repository (replaces -r)
     RESTIC_PASSWORD_FILE                Location of password file (replaces --password-file)
     RESTIC_PASSWORD                     The actual password for the repository