* Git credential store conflicting configuration leads to unexpected behavior
@ 2022-12-06 22:05 Gennady Uraltsev
2022-12-06 22:16 ` brian m. carlson
0 siblings, 1 reply; 6+ messages in thread
From: Gennady Uraltsev @ 2022-12-06 22:05 UTC (permalink / raw)
To: git
Hello everyone,
I have an issue with git credential-store. In my global configuration
dir (.config/git/config) I had the line
[credential]
helper = store
while ini a repository's .git/config while I have
[credential]
helper = "store --file=./.git/git-credentials"
to store credentials "locally".
I thought the latter would overrule the former However what happens is
the following:
1) On first run the file repo-local file ./.git/git-credentials gets
created and the credentials are saved there after the user is queried
for a password
2) On subsequent runs the credentials get recovered from
./.git/git-credentials and the user is NOT asked for credentials
2b) **Here is the weird behavior** git ALSO creates the
.git-credentials file in the home directory and saves a copy of
credentials there.
The behavior 2b leads to exfiltration of passwords to a location a
user might not expect.
Workaround: Remove the line
[credential]
helper = store
in the global config.
It seems that the global config somehow does not get shadowed by the local one!
I think this is a bug with mild security implications.
Let me know.
Best,
Gennady
--
Gennady Uraltsev
<gennady.uraltsev@gmail.com>
(https://guraltsev.github.io)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Git credential store conflicting configuration leads to unexpected behavior
2022-12-06 22:05 Git credential store conflicting configuration leads to unexpected behavior Gennady Uraltsev
@ 2022-12-06 22:16 ` brian m. carlson
2022-12-06 23:53 ` Gennady Uraltsev
0 siblings, 1 reply; 6+ messages in thread
From: brian m. carlson @ 2022-12-06 22:16 UTC (permalink / raw)
To: Gennady Uraltsev; +Cc: git
[-- Attachment #1: Type: text/plain, Size: 1947 bytes --]
On 2022-12-06 at 22:05:22, Gennady Uraltsev wrote:
> Hello everyone,
>
> I have an issue with git credential-store. In my global configuration
> dir (.config/git/config) I had the line
>
> [credential]
> helper = store
>
> while ini a repository's .git/config while I have
>
> [credential]
> helper = "store --file=./.git/git-credentials"
>
> to store credentials "locally".
>
> I thought the latter would overrule the former However what happens is
> the following:
>
> 1) On first run the file repo-local file ./.git/git-credentials gets
> created and the credentials are saved there after the user is queried
> for a password
> 2) On subsequent runs the credentials get recovered from
> ./.git/git-credentials and the user is NOT asked for credentials
> 2b) **Here is the weird behavior** git ALSO creates the
> .git-credentials file in the home directory and saves a copy of
> credentials there.
>
> The behavior 2b leads to exfiltration of passwords to a location a
> user might not expect.
>
> Workaround: Remove the line
>
> [credential]
> helper = store
>
> in the global config.
>
> It seems that the global config somehow does not get shadowed by the local one!
This behaviour is by design. The reason is that sometimes the user may
have two sets of credential helpers, one for one set of domains, and
another for another. For example, I believe AWS has its own custom
credential helper. Git calls credential helpers until it finds a
credential, and then it sends store commands to all of them. A
credential helper which has no credentials for a domain will generally
respond with no credentials.
If you want to override the credential helpers in the `.git/config`
file, you can do so by first writing an empty value, like so:
[credential]
helper =
helper = "store --file=./.git/git-credentials"
--
brian m. carlson (he/him or they/them)
Toronto, Ontario, CA
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 263 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Git credential store conflicting configuration leads to unexpected behavior
2022-12-06 22:16 ` brian m. carlson
@ 2022-12-06 23:53 ` Gennady Uraltsev
2022-12-07 1:15 ` brian m. carlson
2022-12-07 12:01 ` Philip Oakley
0 siblings, 2 replies; 6+ messages in thread
From: Gennady Uraltsev @ 2022-12-06 23:53 UTC (permalink / raw)
To: brian m. carlson, Gennady Uraltsev, git
Thank you!
This makes sense and the solution is simple. Is this somewhere in the
documentation (honest question, I am not being a jerk)? I tried my
best to figure this out before bugging people on the mailinglist.
Best,
Gennady
--
Gennady Uraltsev
<gennady.uraltsev@gmail.com>
(https://guraltsev.github.io)
On Tue, Dec 6, 2022 at 5:16 PM brian m. carlson
<sandals@crustytoothpaste.net> wrote:
>
> On 2022-12-06 at 22:05:22, Gennady Uraltsev wrote:
> > Hello everyone,
> >
> > I have an issue with git credential-store. In my global configuration
> > dir (.config/git/config) I had the line
> >
> > [credential]
> > helper = store
> >
> > while ini a repository's .git/config while I have
> >
> > [credential]
> > helper = "store --file=./.git/git-credentials"
> >
> > to store credentials "locally".
> >
> > I thought the latter would overrule the former However what happens is
> > the following:
> >
> > 1) On first run the file repo-local file ./.git/git-credentials gets
> > created and the credentials are saved there after the user is queried
> > for a password
> > 2) On subsequent runs the credentials get recovered from
> > ./.git/git-credentials and the user is NOT asked for credentials
> > 2b) **Here is the weird behavior** git ALSO creates the
> > .git-credentials file in the home directory and saves a copy of
> > credentials there.
> >
> > The behavior 2b leads to exfiltration of passwords to a location a
> > user might not expect.
> >
> > Workaround: Remove the line
> >
> > [credential]
> > helper = store
> >
> > in the global config.
> >
> > It seems that the global config somehow does not get shadowed by the local one!
>
> This behaviour is by design. The reason is that sometimes the user may
> have two sets of credential helpers, one for one set of domains, and
> another for another. For example, I believe AWS has its own custom
> credential helper. Git calls credential helpers until it finds a
> credential, and then it sends store commands to all of them. A
> credential helper which has no credentials for a domain will generally
> respond with no credentials.
>
> If you want to override the credential helpers in the `.git/config`
> file, you can do so by first writing an empty value, like so:
>
> [credential]
> helper =
> helper = "store --file=./.git/git-credentials"
> --
> brian m. carlson (he/him or they/them)
> Toronto, Ontario, CA
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Git credential store conflicting configuration leads to unexpected behavior
2022-12-06 23:53 ` Gennady Uraltsev
@ 2022-12-07 1:15 ` brian m. carlson
2022-12-07 1:19 ` Gennady Uraltsev
2022-12-07 12:01 ` Philip Oakley
1 sibling, 1 reply; 6+ messages in thread
From: brian m. carlson @ 2022-12-07 1:15 UTC (permalink / raw)
To: Gennady Uraltsev; +Cc: git
[-- Attachment #1: Type: text/plain, Size: 1030 bytes --]
On 2022-12-06 at 23:53:05, Gennady Uraltsev wrote:
> Thank you!
>
> This makes sense and the solution is simple. Is this somewhere in the
> documentation (honest question, I am not being a jerk)? I tried my
> best to figure this out before bugging people on the mailinglist.
Yes, but maybe not where you'd expect. In gitcredentials(7), there's
this text:
If there are multiple instances of the `credential.helper` configuration
variable, each helper will be tried in turn, and may provide a username,
password, or nothing. Once Git has acquired both a username and a
password, no more helpers will be tried.
If `credential.helper` is configured to the empty string, this resets
the helper list to empty (so you may override a helper set by a
lower-priority config file by configuring the empty-string helper,
followed by whatever set of helpers you would like).
The `credential.helper` option mentions that manual page.
--
brian m. carlson (he/him or they/them)
Toronto, Ontario, CA
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 263 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Git credential store conflicting configuration leads to unexpected behavior
2022-12-07 1:15 ` brian m. carlson
@ 2022-12-07 1:19 ` Gennady Uraltsev
0 siblings, 0 replies; 6+ messages in thread
From: Gennady Uraltsev @ 2022-12-07 1:19 UTC (permalink / raw)
To: brian m. carlson, Gennady Uraltsev, git
Thank you! I did miss it. I appreciate your time.
--
Gennady Uraltsev
<gennady.uraltsev@gmail.com>
(https://guraltsev.github.io)
On Tue, Dec 6, 2022 at 8:15 PM brian m. carlson
<sandals@crustytoothpaste.net> wrote:
>
> On 2022-12-06 at 23:53:05, Gennady Uraltsev wrote:
> > Thank you!
> >
> > This makes sense and the solution is simple. Is this somewhere in the
> > documentation (honest question, I am not being a jerk)? I tried my
> > best to figure this out before bugging people on the mailinglist.
>
> Yes, but maybe not where you'd expect. In gitcredentials(7), there's
> this text:
>
> If there are multiple instances of the `credential.helper` configuration
> variable, each helper will be tried in turn, and may provide a username,
> password, or nothing. Once Git has acquired both a username and a
> password, no more helpers will be tried.
>
> If `credential.helper` is configured to the empty string, this resets
> the helper list to empty (so you may override a helper set by a
> lower-priority config file by configuring the empty-string helper,
> followed by whatever set of helpers you would like).
>
> The `credential.helper` option mentions that manual page.
> --
> brian m. carlson (he/him or they/them)
> Toronto, Ontario, CA
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Git credential store conflicting configuration leads to unexpected behavior
2022-12-06 23:53 ` Gennady Uraltsev
2022-12-07 1:15 ` brian m. carlson
@ 2022-12-07 12:01 ` Philip Oakley
1 sibling, 0 replies; 6+ messages in thread
From: Philip Oakley @ 2022-12-07 12:01 UTC (permalink / raw)
To: Gennady Uraltsev, brian m. carlson, git
On 06/12/2022 23:53, Gennady Uraltsev wrote:
> Thank you!
>
> This makes sense and the solution is simple. Is this somewhere in the
> documentation (honest question, I am not being a jerk)? I tried my
> best to figure this out before bugging people on the mailinglist.
I think it's all hidden in the docs, but isn't easy to tease out.
The 'override a multi-value config with a leading empty value"
technique, I think, is covered in the general discussions about how
config values are entered and parsed.
A useful question would be to ask, where did, or would, you look to hope
to find this information? If we put the info in the right place,
sufficient folks will read it.
Philip
PS in-line posting preferred.
>
> Best,
>
> Gennady
>
> --
> Gennady Uraltsev
> <gennady.uraltsev@gmail.com>
> (https://guraltsev.github.io)
>
>
> On Tue, Dec 6, 2022 at 5:16 PM brian m. carlson
> <sandals@crustytoothpaste.net> wrote:
>> On 2022-12-06 at 22:05:22, Gennady Uraltsev wrote:
>>> Hello everyone,
>>>
>>> I have an issue with git credential-store. In my global configuration
>>> dir (.config/git/config) I had the line
>>>
>>> [credential]
>>> helper = store
>>>
>>> while ini a repository's .git/config while I have
>>>
>>> [credential]
>>> helper = "store --file=./.git/git-credentials"
>>>
>>> to store credentials "locally".
>>>
>>> I thought the latter would overrule the former However what happens is
>>> the following:
>>>
>>> 1) On first run the file repo-local file ./.git/git-credentials gets
>>> created and the credentials are saved there after the user is queried
>>> for a password
>>> 2) On subsequent runs the credentials get recovered from
>>> ./.git/git-credentials and the user is NOT asked for credentials
>>> 2b) **Here is the weird behavior** git ALSO creates the
>>> .git-credentials file in the home directory and saves a copy of
>>> credentials there.
>>>
>>> The behavior 2b leads to exfiltration of passwords to a location a
>>> user might not expect.
>>>
>>> Workaround: Remove the line
>>>
>>> [credential]
>>> helper = store
>>>
>>> in the global config.
>>>
>>> It seems that the global config somehow does not get shadowed by the local one!
>> This behaviour is by design. The reason is that sometimes the user may
>> have two sets of credential helpers, one for one set of domains, and
>> another for another. For example, I believe AWS has its own custom
>> credential helper. Git calls credential helpers until it finds a
>> credential, and then it sends store commands to all of them. A
>> credential helper which has no credentials for a domain will generally
>> respond with no credentials.
>>
>> If you want to override the credential helpers in the `.git/config`
>> file, you can do so by first writing an empty value, like so:
>>
>> [credential]
>> helper =
>> helper = "store --file=./.git/git-credentials"
>> --
>> brian m. carlson (he/him or they/them)
>> Toronto, Ontario, CA
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-12-07 12:02 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-06 22:05 Git credential store conflicting configuration leads to unexpected behavior Gennady Uraltsev
2022-12-06 22:16 ` brian m. carlson
2022-12-06 23:53 ` Gennady Uraltsev
2022-12-07 1:15 ` brian m. carlson
2022-12-07 1:19 ` Gennady Uraltsev
2022-12-07 12:01 ` Philip Oakley
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).