google.json is a security risk

[GunnarLieb]

Putting the google.json file is a security risk, it can be read via /modules/contentbox/modules_user/superseo/models/google.json

I think a better approach will to to add it as setting in Conf or as a Setting in database.
I have checked the GoogleCredential Javadocs and couldn't find a method to set Json via string.

So you could to the following
`

var stringReader = createObject("java", "java.io.StringReader");
var googleSettings = stringReader.init(' .... JSON FOLLOWS HERE (PULL FROM SETTINGS
');
variables.ReaderInputStream = createObject("java", "org.apache.commons.io.input.ReaderInputStream");

	var fakeStream = variables.ReaderInputStream.init(googleSettings);
	
	return variables.credential
		.fromStream( fakeStream, //INSTEAD OF variables.fileObj.init(getFileName()),

`

[Tropicalista]

Do you suggest to copy/paste json in a settings?

That way user should edit config manually and do a reinit.

[GunnarLieb]

Either put it in Coldbox.cfc as a setting or make it editable via backend. What suits you the most. If you like I can do a PR for this.

[Tropicalista]

Isn't /modules/contentbox/modules_user/superseo/models/google.json secured by default?

[GunnarLieb]

I tried with my local dev and I could read the json file

[GunnarLieb]

I would say it depends on the rewrite rules in .htaccess which you should not rely on
`#Images, css, javascript and docs, add your own extensions if needed.
RewriteCond %{REQUEST_URI} .(bmp|gif|jpe?g|png|css|js|txt|xls|ico|swf)$
RewriteRule ^(.*)$ - [NC,L]

#The ColdBox index.cfm/{path_info} rules.
RewriteRule ^$ index.cfm [QSA,NS]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.cfm/%{REQUEST_URI} [QSA,L,NS]
`

[Tropicalista]

What if instead of rename the key as google.json, we leave the name that google generates and simply add a setting to specify the correct filename?

It will make more simple for end users to upload and just fill an input box. As security, to access the file the one should know the exact name of the file.

[GunnarLieb]

I somebody forgets to disable directory listing.... I still prefer to have it in db or settings, I can to a Pull Request if you like.

[Tropicalista]

Change the way we load json key means a rewrite of Google.cfc. Why not simply add an htaccess to the models path?