{"thread":{"id":"10082","subject":"[PATCH] Fix problem with authentification on http repository.","startedAt":"2007-09-29T22:26:22Z","lastAt":"2008-07-10T11:30:47Z","messageCount":18,"participants":["jean.guyader@linkea.org","Johannes Schindelin","Junio C Hamano","Mike Hommey","Daniel Stenberg","Jeff King","Andreas Ericsson"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"54376","messageId":"11911047823308-git-send-email-jean.guyader@linkea.org","threadId":"10082","inReplyTo":null,"subject":"[PATCH] Fix problem with authentification on http repository.","fromName":"","fromEmail":"jean.guyader@linkea.org","sentAt":"2007-09-29T22:26:22Z","receivedAt":"2007-09-29T22:26:22Z","isPatch":true,"sender":{"key":"jean.guyader@linkea.org","avatar":null},"body":"From: Jean Guyader \n\nCurl uses the option -u user:passwd and not the user:password\ngiven in the url.\nThe solution was to extract user:password from the url and set\nthe option.\n\nHere the regex used :\n sed -re 's-.*http://([^:]*):([^@]+)@.*-\\1:\\2-g'\n---\n git-clone.sh | 3 ++-\n git-fetch.sh | 8 ++++----\n git-ls-remote.sh | 3 ++-\n 3 files changed, 8 insertions(+), 6 deletions(-)\n\ndiff --git a/git-clone.sh b/git-clone.sh\nindex 5e582fe..57206ac 100755\n--- a/git-clone.sh\n+++ b/git-clone.sh\n@@ -34,7 +34,8 @@ fi\n \n http_fetch () {\n \t# $1 = Remote, $2 = Local\n-\tcurl -nsfL $curl_extra_args \"$1\" >\"$2\" ||\n+ curl_userpw=`echo \"$1\" | sed -re 's-http://([^:]*):([^@]+)@.*-\\1:\\2-g'`\n+\tcurl -u \"$curl_userpw\" -nsfL $curl_extra_args \"$1\" >\"$2\" ||\n \t\tcase $? in\n \t\t126|127) exit ;;\n \t\t*)\t return $? ;;\ndiff --git a/git-fetch.sh b/git-fetch.sh\nindex e44af2c..0b7d055 100755\n--- a/git-fetch.sh\n+++ b/git-fetch.sh\n@@ -268,13 +268,13 @@ fetch_per_ref () {\n \t\t\"`git config --bool http.noEPSV`\" = true ]; then\n \t noepsv_opt=\"--disable-epsv\"\n \t fi\n-\n-\t # Find $remote_name from ls-remote output.\n+ pretty_remote=$(echo \"$remote\" | sed -re 's-http://([^:]+):([^@]+)@-http://\\1:******@-g')\n+ # Find $remote_name from ls-remote output.\n \t head=$(echo \"$ls_remote_result\" | \\\n \t\tgit fetch--tool -s pick-rref \"$remote_name\" \"-\")\n \t expr \"z$head\" : \"z$_x40\\$\" >/dev/null ||\n-\t\tdie \"No such ref $remote_name at $remote\"\n-\t echo >&2 \"Fetching $remote_name from $remote using $proto\"\n+\t\tdie \"No such ref $remote_name at $pretty_remote\"\n+\t echo >&2 \"Fetching $remote_name from $pretty_remote using $proto\"\n \t case \"$quiet\" in '') v=-v ;; *) v= ;; esac\n \t git-http-fetch $v -a \"$head\" \"$remote\" || exit\n \t ;;\ndiff --git a/git-ls-remote.sh b/git-ls-remote.sh\nindex d56cf92..d6e9906 100755\n--- a/git-ls-remote.sh\n+++ b/git-ls-remote.sh\n@@ -61,7 +61,8 @@ http://* | https://* | ftp://* )\n \t\t\"`git config --bool http.noEPSV`\" = true ]; then\n \t\tcurl_extra_args=\"${curl_extra_args} --disable-epsv\"\n \tfi\n-\tcurl -nsf $curl_extra_args --header \"Pragma: no-cache\" \"$peek_repo/info/refs\" ||\n+ curl_userpw=`echo \"$peek_repo\" | sed -re 's-.*http://([^:]*):([^@]+)@.*-\\1:\\2-g'`\n+\tcurl -u \"$curl_userpw\" -nsf $curl_extra_args --header \"Pragma: no-cache\" \"$peek_repo/info/refs\" ||\n \t\techo \"failed\tslurping\"\n \t;;\n \n-- \n1.5.2.4\n"},{"id":"54378","messageId":"Pine.LNX.4.64.0709300009580.28395@racer.site","threadId":"10082","inReplyTo":"11911047823308-git-send-email-jean.guyader@linkea.org","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2007-09-29T23:10:27Z","receivedAt":"2007-09-29T23:10:27Z","isPatch":true,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nOn Sun, 30 Sep 2007, jean.guyader@linkea.org wrote:\n\n> git-clone.sh | 3 ++-\n> git-fetch.sh | 8 ++++----\n> git-ls-remote.sh | 3 ++-\n\ngit-fetch is already a builtin in \"next\", and -clone and -ls-remote are \nlikely to follow suit.\n\nCiao,\nDscho\n"},{"id":"54381","messageId":"7v8x6pjb4c.fsf@gitster.siamese.dyndns.org","threadId":"10082","inReplyTo":"11911047823308-git-send-email-jean.guyader@linkea.org","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2007-09-29T23:38:27Z","receivedAt":"2007-09-29T23:38:27Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"jean.guyader@linkea.org writes:\n\n> From: Jean Guyader \n>\n> Curl uses the option -u user:passwd and not the user:password\n> given in the url.\n> The solution was to extract user:password from the url and set\n> the option.\n>\n> Here the regex used :\n> sed -re 's-.*http://([^:]*):([^@]+)@.*-\\1:\\2-g'\n\nThis is more like \"allowing embedded authentication credentials\nin URL for http transport\".\n\nWe never supported URLs with embedded credentials (see\nDocumentation/urls.txt), partly because nobody asked for it, but\nmore importantly because giving -n to curl to have it read from\nuser's .netrc is generally much more preferred approach.\n"},{"id":"54383","messageId":"Pine.LNX.4.64.0709300039430.28395@racer.site","threadId":"10082","inReplyTo":"7v8x6pjb4c.fsf@gitster.siamese.dyndns.org","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2007-09-29T23:40:41Z","receivedAt":"2007-09-29T23:40:41Z","isPatch":true,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nOn Sat, 29 Sep 2007, Junio C Hamano wrote:\n\n> jean.guyader@linkea.org writes:\n> \n> > From: Jean Guyader \n> >\n> > Curl uses the option -u user:passwd and not the user:password\n> > given in the url.\n> > The solution was to extract user:password from the url and set\n> > the option.\n> >\n> > Here the regex used :\n> > sed -re 's-.*http://([^:]*):([^@]+)@.*-\\1:\\2-g'\n> \n> This is more like \"allowing embedded authentication credentials\n> in URL for http transport\".\n> \n> We never supported URLs with embedded credentials (see\n> Documentation/urls.txt), partly because nobody asked for it, but\n> more importantly because giving -n to curl to have it read from\n> user's .netrc is generally much more preferred approach.\n\nTo elaborate on that: if you fetch from somewhere, your url, username and \npassword can be read from the output of \"ps ax | grep http\" very easily.\n\nCiao,\nDscho\n"},{"id":"54384","messageId":"7v4phdja01.fsf@gitster.siamese.dyndns.org","threadId":"10082","inReplyTo":"Pine.LNX.4.64.0709300039430.28395@racer.site","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2007-09-30T00:02:38Z","receivedAt":"2007-09-30T00:02:38Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Johannes Schindelin writes:\n\n> On Sat, 29 Sep 2007, Junio C Hamano wrote:\n>\n>> We never supported URLs with embedded credentials (see\n>> Documentation/urls.txt), partly because nobody asked for it, but\n>> more importantly because giving -n to curl to have it read from\n>> user's .netrc is generally much more preferred approach.\n>\n> To elaborate on that: if you fetch from somewhere, your url, username and \n> password can be read from the output of \"ps ax | grep http\" very easily.\n\nActually Documentation/howto/setup-git-server-over-http.txt\ntalks about http://user@server/path/ format. How well does this\nwork in practice? If it does, we should update Documentation/urls.txt\nto allow optional user@ there like...\n\n---\n\n Documentation/urls.txt | 4 ++--\n 1 files changed, 2 insertions(+), 2 deletions(-)\n\ndiff --git a/Documentation/urls.txt b/Documentation/urls.txt\nindex e67f914..c9aab86 100644\n--- a/Documentation/urls.txt\n+++ b/Documentation/urls.txt\n@@ -6,8 +6,8 @@ to name the remote repository:\n \n ===============================================================\n - rsync://host.xz/path/to/repo.git/\n-- http://host.xz/path/to/repo.git/\n-- https://host.xz/path/to/repo.git/\n+- http://{startsb}user@{endsb}host.xz/path/to/repo.git/\n+- https://{startsb}user@{endsb}host.xz/path/to/repo.git/\n - git://host.xz/path/to/repo.git/\n - git://host.xz/~user/path/to/repo.git/\n - ssh://{startsb}user@{endsb}host.xz{startsb}:port{endsb}/path/to/repo.git/\n"},{"id":"82687","messageId":"7v4p6zmx0l.fsf@gitster.siamese.dyndns.org","threadId":"10082","inReplyTo":"7v4phdja01.fsf@gitster.siamese.dyndns.org","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2008-07-09T05:44:58Z","receivedAt":"2008-07-09T05:44:58Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Johannes Schindelin writes:\n\n> On Sat, 29 Sep 2007, Junio C Hamano wrote:\n>\n>> We never supported URLs with embedded credentials (see\n>> Documentation/urls.txt), partly because nobody asked for it, but\n>> more importantly because giving -n to curl to have it read from\n>> user's .netrc is generally much more preferred approach.\n>\n> To elaborate on that: if you fetch from somewhere, your url, username and \n> password can be read from the output of \"ps ax | grep http\" very easily.\n\nActually Documentation/howto/setup-git-server-over-http.txt\ntalks about http://user@server/path/ format. How well does this\nwork in practice? If it does, we should update Documentation/urls.txt\nto allow optional user@ there like...\n\n---\n\n Documentation/urls.txt | 4 ++--\n 1 files changed, 2 insertions(+), 2 deletions(-)\n\ndiff --git a/Documentation/urls.txt b/Documentation/urls.txt\nindex e67f914..c9aab86 100644\n--- a/Documentation/urls.txt\n+++ b/Documentation/urls.txt\n@@ -6,8 +6,8 @@ to name the remote repository:\n \n ===============================================================\n - rsync://host.xz/path/to/repo.git/\n-- http://host.xz/path/to/repo.git/\n-- https://host.xz/path/to/repo.git/\n+- http://{startsb}user@{endsb}host.xz/path/to/repo.git/\n+- https://{startsb}user@{endsb}host.xz/path/to/repo.git/\n - git://host.xz/path/to/repo.git/\n - git://host.xz/~user/path/to/repo.git/\n - ssh://{startsb}user@{endsb}host.xz{startsb}:port{endsb}/path/to/repo.git/\n"},{"id":"82688","messageId":"20080709055150.GA28482@glandium.org","threadId":"10082","inReplyTo":"7v4p6zmx0l.fsf@gitster.siamese.dyndns.org","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Mike Hommey","fromEmail":"mh@glandium.org","sentAt":"2008-07-09T05:51:50Z","receivedAt":"2008-07-09T05:51:50Z","isPatch":true,"sender":{"key":"mh@glandium.org","avatar":"https://avatars.githubusercontent.com/u/1038527?v=4"},"body":"On Tue, Jul 08, 2008 at 10:44:58PM -0700, Junio C Hamano wrote:\n> Johannes Schindelin writes:\n> \n> > On Sat, 29 Sep 2007, Junio C Hamano wrote:\n> >\n> >> We never supported URLs with embedded credentials (see\n> >> Documentation/urls.txt), partly because nobody asked for it, but\n> >> more importantly because giving -n to curl to have it read from\n> >> user's .netrc is generally much more preferred approach.\n> >\n> > To elaborate on that: if you fetch from somewhere, your url, username and \n> > password can be read from the output of \"ps ax | grep http\" very easily.\n> \n> Actually Documentation/howto/setup-git-server-over-http.txt\n> talks about http://user@server/path/ format. How well does this\n> work in practice? If it does, we should update Documentation/urls.txt\n> to allow optional user@ there like...\n\nAFAIK, there is nothing to deal with asking a password to the user in git\nin this case, so that doesn't work.\n\nMike\n"},{"id":"82691","messageId":"7vlk0blgg0.fsf@gitster.siamese.dyndns.org","threadId":"10082","inReplyTo":"20080709055150.GA28482@glandium.org","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2008-07-09T06:28:15Z","receivedAt":"2008-07-09T06:28:15Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Mike Hommey writes:\n\n> On Tue, Jul 08, 2008 at 10:44:58PM -0700, Junio C Hamano wrote:\n>> Johannes Schindelin writes:\n>> \n>> > On Sat, 29 Sep 2007, Junio C Hamano wrote:\n>> >\n>> >> We never supported URLs with embedded credentials (see\n>> >> Documentation/urls.txt), partly because nobody asked for it, but\n>> >> more importantly because giving -n to curl to have it read from\n>> >> user's .netrc is generally much more preferred approach.\n>> >\n>> > To elaborate on that: if you fetch from somewhere, your url, username and \n>> > password can be read from the output of \"ps ax | grep http\" very easily.\n>> \n>> Actually Documentation/howto/setup-git-server-over-http.txt\n>> talks about http://user@server/path/ format. How well does this\n>> work in practice? If it does, we should update Documentation/urls.txt\n>> to allow optional user@ there like...\n>\n> AFAIK, there is nothing to deal with asking a password to the user in git\n> in this case, so that doesn't work.\n\nThen perhaps the howto needs updating?\n"},{"id":"82695","messageId":"20080709075345.GA22022@glandium.org","threadId":"10082","inReplyTo":"7vlk0blgg0.fsf@gitster.siamese.dyndns.org","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Mike Hommey","fromEmail":"mh@glandium.org","sentAt":"2008-07-09T07:53:46Z","receivedAt":"2008-07-09T07:53:46Z","isPatch":true,"sender":{"key":"mh@glandium.org","avatar":"https://avatars.githubusercontent.com/u/1038527?v=4"},"body":"On Tue, Jul 08, 2008 at 11:28:15PM -0700, Junio C Hamano wrote:\n> Mike Hommey writes:\n> \n> > On Tue, Jul 08, 2008 at 10:44:58PM -0700, Junio C Hamano wrote:\n> >> Johannes Schindelin writes:\n> >> \n> >> > On Sat, 29 Sep 2007, Junio C Hamano wrote:\n> >> >\n> >> >> We never supported URLs with embedded credentials (see\n> >> >> Documentation/urls.txt), partly because nobody asked for it, but\n> >> >> more importantly because giving -n to curl to have it read from\n> >> >> user's .netrc is generally much more preferred approach.\n> >> >\n> >> > To elaborate on that: if you fetch from somewhere, your url, username and \n> >> > password can be read from the output of \"ps ax | grep http\" very easily.\n> >> \n> >> Actually Documentation/howto/setup-git-server-over-http.txt\n> >> talks about http://user@server/path/ format. How well does this\n> >> work in practice? If it does, we should update Documentation/urls.txt\n> >> to allow optional user@ there like...\n> >\n> > AFAIK, there is nothing to deal with asking a password to the user in git\n> > in this case, so that doesn't work.\n> \n> Then perhaps the howto needs updating?\n\nActually, the howto tells to setup a ~/.netrc file, which should make\nthe http://user@server/path/ format work. I don't know if dropping user@\nwould still work, that depends how libcurl works with it.\n\nMike\n"},{"id":"82696","messageId":"alpine.LRH.1.10.0807090955520.5588@yvahk3.pbagnpgbe.fr","threadId":"10082","inReplyTo":"20080709075345.GA22022@glandium.org","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Daniel Stenberg","fromEmail":"daniel@haxx.se","sentAt":"2008-07-09T08:04:56Z","receivedAt":"2008-07-09T08:04:56Z","isPatch":true,"sender":{"key":"daniel@haxx.se","avatar":"https://gravatar.com/avatar/69fdca87edd17cee21ca2e79fc2ff671d644603c3dc27167430f3cd3dbab7ba8?d=mp&s=160"},"body":"On Wed, 9 Jul 2008, Mike Hommey wrote:\n\n> Actually, the howto tells to setup a ~/.netrc file, which should make\n> the http://user@server/path/ format work. I don't know if dropping user@\n> would still work, that depends how libcurl works with it.\n\ngit has the netrc parser set to \"optional\", which makes libcurl use the login \nname given in the URL (if present) and search for the associated password in \nthe .netrc file.\n\nTypical users probably only have one user per host name in the .netrc file and \nthen the name part in the URL provides no particular extra goodness but can \njust as well be excluded.\n\n-- \n\n / daniel.haxx.se\n"},{"id":"82697","messageId":"7vhcazlbch.fsf@gitster.siamese.dyndns.org","threadId":"10082","inReplyTo":"20080709075345.GA22022@glandium.org","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2008-07-09T08:18:22Z","receivedAt":"2008-07-09T08:18:22Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Mike Hommey writes:\n\n> On Tue, Jul 08, 2008 at 11:28:15PM -0700, Junio C Hamano wrote:\n> ...\n>> >> Actually Documentation/howto/setup-git-server-over-http.txt\n>> >> talks about http://user@server/path/ format. How well does this\n>> >> work in practice? If it does, we should update Documentation/urls.txt\n>> >> to allow optional user@ there like...\n>> >\n>> > AFAIK, there is nothing to deal with asking a password to the user in git\n>> > in this case, so that doesn't work.\n>> \n>> Then perhaps the howto needs updating?\n>\n> Actually, the howto tells to setup a ~/.netrc file, which should make\n> the http://user@server/path/ format work. I don't know if dropping user@\n> would still work, that depends how libcurl works with it.\n\nOk, so the documentation update I suggested earlier may actually be\nvalid, right?\n"},{"id":"82698","messageId":"20080709085651.GA23453@glandium.org","threadId":"10082","inReplyTo":"7vhcazlbch.fsf@gitster.siamese.dyndns.org","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Mike Hommey","fromEmail":"mh@glandium.org","sentAt":"2008-07-09T08:56:52Z","receivedAt":"2008-07-09T08:56:52Z","isPatch":true,"sender":{"key":"mh@glandium.org","avatar":"https://avatars.githubusercontent.com/u/1038527?v=4"},"body":"On Wed, Jul 09, 2008 at 01:18:22AM -0700, Junio C Hamano wrote:\n> Mike Hommey writes:\n> \n> > On Tue, Jul 08, 2008 at 11:28:15PM -0700, Junio C Hamano wrote:\n> > ...\n> >> >> Actually Documentation/howto/setup-git-server-over-http.txt\n> >> >> talks about http://user@server/path/ format. How well does this\n> >> >> work in practice? If it does, we should update Documentation/urls.txt\n> >> >> to allow optional user@ there like...\n> >> >\n> >> > AFAIK, there is nothing to deal with asking a password to the user in git\n> >> > in this case, so that doesn't work.\n> >> \n> >> Then perhaps the howto needs updating?\n> >\n> > Actually, the howto tells to setup a ~/.netrc file, which should make\n> > the http://user@server/path/ format work. I don't know if dropping user@\n> > would still work, that depends how libcurl works with it.\n> \n> Ok, so the documentation update I suggested earlier may actually be\n> valid, right?\n\nThe problem is that these urls won't work out of the box if the user\ndoesn't setup a .netrc file. I'd say it would be better not to add these\nforms in Documentation/urls.txt until git prompts for the password\nwhen it is missing.\n\nNote that http://user:pass@server/path/ /should/ work (but that would\nneed validation), though not a good idea on command line.\n\nMike\n"},{"id":"82708","messageId":"alpine.DEB.1.00.0807091341230.5277@eeepc-johanness","threadId":"10082","inReplyTo":"20080709085651.GA23453@glandium.org","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2008-07-09T11:43:07Z","receivedAt":"2008-07-09T11:43:07Z","isPatch":true,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nOn Wed, 9 Jul 2008, Mike Hommey wrote:\n\n> Note that http://user:pass@server/path/ /should/ work (but that would \n> need validation), though not a good idea on command line.\n\nWell, now that the programs using URLs are all builtins, we can actually \ndo something about it. We can edit out the \"user[:pass]@\" part out of \nargv, which usually means that \"ps\" will not see it anymore.\n\nCiao,\nDscho\n"},{"id":"82787","messageId":"20080710072420.GA5167@sigill.intra.peff.net","threadId":"10082","inReplyTo":"alpine.DEB.1.00.0807091341230.5277@eeepc-johanness","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2008-07-10T07:24:20Z","receivedAt":"2008-07-10T07:24:20Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Wed, Jul 09, 2008 at 01:43:07PM +0200, Johannes Schindelin wrote:\n\n> > Note that http://user:pass@server/path/ /should/ work (but that would \n> > need validation), though not a good idea on command line.\n> \n> Well, now that the programs using URLs are all builtins, we can actually \n> do something about it. We can edit out the \"user[:pass]@\" part out of \n> argv, which usually means that \"ps\" will not see it anymore.\n\nWouldn't there still be a race condition for publicly broadcasting your\npassword via ps?\n\n-Peff\n"},{"id":"82789","messageId":"7vk5fuqjn8.fsf@gitster.siamese.dyndns.org","threadId":"10082","inReplyTo":"20080710072420.GA5167@sigill.intra.peff.net","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2008-07-10T07:32:27Z","receivedAt":"2008-07-10T07:32:27Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jeff King writes:\n\n> On Wed, Jul 09, 2008 at 01:43:07PM +0200, Johannes Schindelin wrote:\n>\n>> > Note that http://user:pass@server/path/ /should/ work (but that would \n>> > need validation), though not a good idea on command line.\n>> \n>> Well, now that the programs using URLs are all builtins, we can actually \n>> do something about it. We can edit out the \"user[:pass]@\" part out of \n>> argv, which usually means that \"ps\" will not see it anymore.\n>\n> Wouldn't there still be a race condition for publicly broadcasting your\n> password via ps?\n\nIn addition, I think on some Unices overwriting argv[0] does not have the\neffect Dscho is aiming for.\n\nI thought we do discourage [:pass] part in our documentation.\n"},{"id":"82798","messageId":"20080710084728.GA6199@sigill.intra.peff.net","threadId":"10082","inReplyTo":"7vk5fuqjn8.fsf@gitster.siamese.dyndns.org","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2008-07-10T08:47:28Z","receivedAt":"2008-07-10T08:47:28Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Thu, Jul 10, 2008 at 12:32:27AM -0700, Junio C Hamano wrote:\n\n> > Wouldn't there still be a race condition for publicly broadcasting your\n> > password via ps?\n> \n> In addition, I think on some Unices overwriting argv[0] does not have the\n> effect Dscho is aiming for.\n\nI thought so, too, but I couldn't find any mention of it online. For\ncuriosity's sake, do you happen to know offhand any platform where this\ndoesn't work (of course, Dscho is really proposing overwriting argv[i],\nbut I don't know if that makes a difference to the portability)?\n\n-Peff\n"},{"id":"82806","messageId":"alpine.DEB.1.00.0807101248360.3135@eeepc-johanness","threadId":"10082","inReplyTo":"20080710072420.GA5167@sigill.intra.peff.net","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2008-07-10T10:51:34Z","receivedAt":"2008-07-10T10:51:34Z","isPatch":true,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nOn Thu, 10 Jul 2008, Jeff King wrote:\n\n> On Wed, Jul 09, 2008 at 01:43:07PM +0200, Johannes Schindelin wrote:\n> \n> > > Note that http://user:pass@server/path/ /should/ work (but that \n> > > would need validation), though not a good idea on command line.\n> > \n> > Well, now that the programs using URLs are all builtins, we can \n> > actually do something about it. We can edit out the \"user[:pass]@\" \n> > part out of argv, which usually means that \"ps\" will not see it \n> > anymore.\n> \n> Wouldn't there still be a race condition for publicly broadcasting your \n> password via ps?\n\nYes. For a brief amount of time, but yes.\n\nBTW I thought I remembered one program xxx'ing out the password via argv, \nbut unfortunately I do not remember which one it was.\n\nAnyway, was just an idea.\n\nCiao,\nDscho\n"},{"id":"82807","messageId":"4875F2E7.1010209@op5.se","threadId":"10082","inReplyTo":"alpine.DEB.1.00.0807101248360.3135@eeepc-johanness","subject":"Re: [PATCH] Fix problem with authentification on http repository.","fromName":"Andreas Ericsson","fromEmail":"ae@op5.se","sentAt":"2008-07-10T11:30:47Z","receivedAt":"2008-07-10T11:30:47Z","isPatch":true,"sender":{"key":"ae@op5.se","avatar":"https://gravatar.com/avatar/426e89595c75a8f5252dd0c989e5fabe5bcac616e68557427ad9aef6b0ca342a?d=mp&s=160"},"body":"Johannes Schindelin wrote:\n> Hi,\n> \n> On Thu, 10 Jul 2008, Jeff King wrote:\n> \n>> On Wed, Jul 09, 2008 at 01:43:07PM +0200, Johannes Schindelin wrote:\n>>\n>>>> Note that http://user:pass@server/path/ /should/ work (but that \n>>>> would need validation), though not a good idea on command line.\n>>> Well, now that the programs using URLs are all builtins, we can \n>>> actually do something about it. We can edit out the \"user[:pass]@\" \n>>> part out of argv, which usually means that \"ps\" will not see it \n>>> anymore.\n>> Wouldn't there still be a race condition for publicly broadcasting your \n>> password via ps?\n> \n> Yes. For a brief amount of time, but yes.\n> \n> BTW I thought I remembered one program xxx'ing out the password via argv, \n> but unfortunately I do not remember which one it was.\n> \n\nThe mysql client does (or did) it, although perhaps only on systems that\nsupport it.\n\n-- \nAndreas Ericsson andreas.ericsson@op5.se\nOP5 AB www.op5.se\nTel: +46 8-230225 Fax: +46 8-230231\n"}]}