From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS53758 23.128.96.0/24 X-Spam-Status: No, score=-3.8 required=3.0 tests=AWL,BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_PASS, SPF_PASS shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by dcvr.yhbt.net (Postfix) with ESMTP id 20B9E1F8C1 for ; Sun, 3 May 2020 10:06:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728018AbgECKG2 (ORCPT ); Sun, 3 May 2020 06:06:28 -0400 Received: from cloud.peff.net ([104.130.231.41]:35088 "HELO cloud.peff.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S1727971AbgECKG2 (ORCPT ); Sun, 3 May 2020 06:06:28 -0400 Received: (qmail 22471 invoked by uid 109); 3 May 2020 10:06:28 -0000 Received: from Unknown (HELO peff.net) (10.0.1.2) by cloud.peff.net (qpsmtpd/0.94) with SMTP; Sun, 03 May 2020 10:06:28 +0000 Authentication-Results: cloud.peff.net; auth=none Received: (qmail 5006 invoked by uid 111); 3 May 2020 10:06:30 -0000 Received: from coredump.intra.peff.net (HELO sigill.intra.peff.net) (10.0.0.2) by peff.net (qpsmtpd/0.94) with (TLS_AES_256_GCM_SHA384 encrypted) ESMTPS; Sun, 03 May 2020 06:06:30 -0400 Authentication-Results: peff.net; auth=none Date: Sun, 3 May 2020 06:06:27 -0400 From: Jeff King To: Junio C Hamano Cc: Carlo Marcelo Arenas =?utf-8?B?QmVsw7Nu?= , git@vger.kernel.org, dirk@ed4u.de, sunshine@sunshineco.com, jrnieder@gmail.com, Johannes.Schindelin@gmx.de Subject: Re: [PATCH v10] credential-store: ignore bogus lines from store file Message-ID: <20200503100627.GA171296@coredump.intra.peff.net> References: <20200430160642.90096-1-carenas@gmail.com> <20200502181643.38203-1-carenas@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Sender: git-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org On Sat, May 02, 2020 at 01:47:09PM -0700, Junio C Hamano wrote: > > As a special case, flag files with CRLF endings as invalid early > > to prevent current problems in credential_from_url_gently() with > > handling of '\r' in the host. > > I do not think it hurts to silently ignore a line that ends with CR, > but only because I do not think credential_from_url_gently() would > not match such a line when asked to match something without > complaining. I wondered if we might hit a case where the CR ends up in the path, like: $ printf 'https://user:pass@example.com/\r\n' >creds $ echo url=https://example.com/ | git credential-store --file=creds get username=user password=pass because the path is parsed as missing in the incoming pattern (and thus we match any path, even "\r"). But credential-store would never write such a path in the first place. Even with the trailing slash on an incoming URL, it will write: https://example.com without a slash at all (and thus any inserted CR would be part of the hostname). So somebody would have to have inserted it themselves, or have turned useHTTPPath on (in which case we _would_ complain on the matching side, too, because we'd try matching the path with a CR in it). I think it's reasonable to assume that any CR would have been a problem even in older versions. -Peff