{"thread":{"id":"42836","subject":"Https password present in git output","startedAt":"2016-07-13T17:56:05Z","lastAt":"2016-07-13T23:37:02Z","messageCount":6,"participants":["ervion","Junio C Hamano","Dennis Kaarsemaker","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"291373","messageId":"2908abd39c722c080ec37a987a79e32f@cryptolab.net","threadId":"42836","inReplyTo":null,"subject":"Https password present in git output","fromName":"ervion","fromEmail":"ervion@cryptolab.net","sentAt":"2016-07-13T17:26:27Z","receivedAt":"2016-07-13T17:56:05Z","isPatch":false,"sender":{"key":"ervion@cryptolab.net","avatar":null},"body":"\nSometimes using ssh is not possible and saving https password in plain \ntext to disk may be desireable\n(in case of encrypted disk it would be equivalent security with caching \npassword in memory).\n\nOne possibility for this in git is to save remote in the \nhttps://username:password@domain.com/repo.git format.\nHowever, in this case every time you push or pull, the remote address, \nincluding the plain text password.\nThat would introduce additional security issiues and is unreasonable?\n\nWouldn't it make sense to scrabble the password part in remote's url \nbefore printing it to output?\n"},{"id":"291375","messageId":"xmqqd1mh1kbd.fsf@gitster.mtv.corp.google.com","threadId":"42836","inReplyTo":"2908abd39c722c080ec37a987a79e32f@cryptolab.net","subject":"Re: Https password present in git output","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2016-07-13T18:09:42Z","receivedAt":"2016-07-13T18:11:31Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"ervion writes:\n\n> Sometimes using ssh is not possible and saving https password in plain\n> text to disk may be desireable\n> (in case of encrypted disk it would be equivalent security with\n> caching password in memory).\n>\n> One possibility for this in git is to save remote in the\n> https://username:password@domain.com/repo.git format.\n\nWasn't netrc support added exactly because users do not want to do\nthis?\n"},{"id":"291376","messageId":"1468433762.4649.6.camel@kaarsemaker.net","threadId":"42836","inReplyTo":"2908abd39c722c080ec37a987a79e32f@cryptolab.net","subject":"Re: Https password present in git output","fromName":"Dennis Kaarsemaker","fromEmail":"dennis@kaarsemaker.net","sentAt":"2016-07-13T18:16:02Z","receivedAt":"2016-07-13T18:16:30Z","isPatch":false,"sender":{"key":"dennis@kaarsemaker.net","avatar":"https://avatars.githubusercontent.com/u/200649?v=4"},"body":"On wo, 2016-07-13 at 20:26 +0300, ervion wrote:\n> One possibility for this in git is to save remote in the \n> https://username:password@domain.com/repo.git format.\n\nThis is not recommended. Git has credential helpers to help you store\npasswords outside the git configuration.\n\nWhich then makes your original problem go away :)\n\nD.\n"},{"id":"291377","messageId":"CAPc5daXq-WBEYTyi2M7kMoZtQCYgucCRQ=GFVt8U_H_vRYyZPw@mail.gmail.com","threadId":"42836","inReplyTo":"xmqqd1mh1kbd.fsf@gitster.mtv.corp.google.com","subject":"Re: Https password present in git output","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2016-07-13T18:16:27Z","receivedAt":"2016-07-13T18:16:59Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"On Wed, Jul 13, 2016 at 11:09 AM, Junio C Hamano wrote:\n> ervion writes:\n>\n>> Sometimes using ssh is not possible and saving https password in plain\n>> text to disk may be desireable\n>> (in case of encrypted disk it would be equivalent security with\n>> caching password in memory).\n>>\n>> One possibility for this in git is to save remote in the\n>> https://username:password@domain.com/repo.git format.\n>\n> Wasn't netrc support added exactly because users do not want to do\n> this?\n\nInteresting. Even with \"auth in URL\", I seem to get this:\n\n$ git fetch -v -v https://gitster:pass@github.com/git/git refs/tags/v2.9.1\nFrom https://github.com/git/git\n * tag v2.9.1 -> FETCH_HEAD\n\nNotice that \"From $URL\" has the userinfo (3.2.1 in RFC 3986) scrubbed.\n\nIf you are seeing somewhere we forgot to scrub userinfo in a similar way in\nthe output, we should. Where do you see \"present in git OUTPUT\" as you\nsaid in the subject? What command with what options exactly and in what\npart of the output?\n\nThanks.\n"},{"id":"291397","messageId":"2bd57007f21ab1154d3bcc1e9bc8664e@cryptolab.net","threadId":"42836","inReplyTo":"CAPc5daXq-WBEYTyi2M7kMoZtQCYgucCRQ=GFVt8U_H_vRYyZPw@mail.gmail.com","subject":"Re: Https password present in git output","fromName":"ervion","fromEmail":"ervion@cryptolab.net","sentAt":"2016-07-13T22:36:52Z","receivedAt":"2016-07-13T23:10:38Z","isPatch":false,"sender":{"key":"ervion@cryptolab.net","avatar":null},"body":"\nI completely agree that it is not a head-on-fire kind of problem, there \nare ways to avoid it.\nSimply nice to have.\n\nIt is in fact the case, that git fetch output is scrubbed, sorry I did \nnot notice previously.\nBut (on my device: git version 2.9.0 arch linux) git push is not.\n$ git push origin --all\n\nResults in:\n/---/\nTo https://username:password@domeen.com/git/repo.git\n xxxxxxx..zzzzzzz master -> master\n\nOn 13.07.2016 21:16, Junio C Hamano wrote:\n> On Wed, Jul 13, 2016 at 11:09 AM, Junio C Hamano \n> wrote:\n>> ervion writes:\n>> \n>>> Sometimes using ssh is not possible and saving https password in \n>>> plain\n>>> text to disk may be desireable\n>>> (in case of encrypted disk it would be equivalent security with\n>>> caching password in memory).\n>>> \n>>> One possibility for this in git is to save remote in the\n>>> https://username:password@domain.com/repo.git format.\n>> \n>> Wasn't netrc support added exactly because users do not want to do\n>> this?\n> \n> Interesting. Even with \"auth in URL\", I seem to get this:\n> \n> $ git fetch -v -v https://gitster:pass@github.com/git/git \n> refs/tags/v2.9.1\n> From https://github.com/git/git\n> * tag v2.9.1 -> FETCH_HEAD\n> \n> Notice that \"From $URL\" has the userinfo (3.2.1 in RFC 3986) scrubbed.\n> \n> If you are seeing somewhere we forgot to scrub userinfo in a similar \n> way in\n> the output, we should. Where do you see \"present in git OUTPUT\" as you\n> said in the subject? What command with what options exactly and in what\n> part of the output?\n> \n> Thanks.\n"},{"id":"291398","messageId":"20160713233653.GA9900@sigill.intra.peff.net","threadId":"42836","inReplyTo":"2bd57007f21ab1154d3bcc1e9bc8664e@cryptolab.net","subject":"Re: Https password present in git output","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2016-07-13T23:36:53Z","receivedAt":"2016-07-13T23:37:02Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Thu, Jul 14, 2016 at 01:36:52AM +0300, ervion wrote:\n\n> It is in fact the case, that git fetch output is scrubbed, sorry I did not\n> notice previously.\n> But (on my device: git version 2.9.0 arch linux) git push is not.\n> $ git push origin --all\n\nMaybe this?\n\n-- >8 --\nSubject: [PATCH] push: anonymize URL in status output\n\nCommit 47abd85 (fetch: Strip usernames from url's before\nstoring them, 2009-04-17) taught fetch to anonymize URLs.\nThe primary purpose there was to avoid sticking passwords in\nmerge-commit messages, but as a side effect, we also avoid\nprinting them to stderr.\n\nThe push side does not have the merge-commit problem, but it\nprobably should avoid printing them to stderr. We can reuse\nthe same anonymizing function.\n\nNote that for this to come up, the credentials would have to\nappear either on the command line or in a git config file,\nneither of which is particularly secure. So people _should_\nbe switching to using credential helpers instead, which\nmakes this problem go away. But that's no excuse not to\nimprove the situation for people who for whatever reason end\nup using credentials embedded in the URL.\n\nSigned-off-by: Jeff King \n---\n t/t5541-http-push-smart.sh | 7 +++++++\n transport.c | 7 +++++--\n 2 files changed, 12 insertions(+), 2 deletions(-)\n\ndiff --git a/t/t5541-http-push-smart.sh b/t/t5541-http-push-smart.sh\nindex fd7d06b..8d08e06 100755\n--- a/t/t5541-http-push-smart.sh\n+++ b/t/t5541-http-push-smart.sh\n@@ -368,5 +368,12 @@ test_expect_success GPG 'push with post-receive to inspect certificate' '\n \ttest_cmp expect \"$HTTPD_DOCUMENT_ROOT_PATH/push-cert-status\"\n '\n \n+test_expect_success 'push status output scrubs password' '\n+\ttest_commit scrub &&\n+\tgit push --porcelain \"$HTTPD_URL_USER_PASS/smart/test_repo.git\" >status &&\n+\t# should have been scrubbed down to vanilla URL\n+\tgrep \"^To $HTTPD_URL/smart/test_repo.git\" status\n+'\n+\n stop_httpd\n test_done\ndiff --git a/transport.c b/transport.c\nindex 095e61f..be4a63e 100644\n--- a/transport.c\n+++ b/transport.c\n@@ -359,8 +359,11 @@ static void print_ok_ref_status(struct ref *ref, int porcelain)\n \n static int print_one_push_status(struct ref *ref, const char *dest, int count, int porcelain)\n {\n-\tif (!count)\n-\t\tfprintf(porcelain ? stdout : stderr, \"To %s\\n\", dest);\n+\tif (!count) {\n+\t\tchar *url = transport_anonymize_url(dest);\n+\t\tfprintf(porcelain ? stdout : stderr, \"To %s\\n\", url);\n+\t\tfree(url);\n+\t}\n \n \tswitch(ref->status) {\n \tcase REF_STATUS_NONE:\n-- \n2.9.1.356.g3c37bc7\n\n"}]}