{"thread":{"id":"51819","subject":"[BUG] Password cannot contain hash","startedAt":"2019-09-09T21:19:27Z","lastAt":"2019-09-09T22:15:04Z","messageCount":3,"participants":["Sebastian Gniazdowski","Junio C Hamano","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"382101","messageId":"CAKc7PVDT0JXCAW=aON2jXidCgib=SjoUXU6Yh4t+xWB8QW4NPQ@mail.gmail.com","threadId":"51819","inReplyTo":null,"subject":"[BUG] Password cannot contain hash","fromName":"Sebastian Gniazdowski","fromEmail":"sgniazdowski@gmail.com","sentAt":"2019-09-09T21:18:46Z","receivedAt":"2019-09-09T21:19:27Z","isPatch":false,"sender":{"key":"sgniazdowski@gmail.com","avatar":"https://gravatar.com/avatar/4fe8402ad2382744749d089f9c26c9a9fd58c4265afcc0a945d2869cad528e39?d=mp&s=160"},"body":"Hello,\nif the password contains a hash, then it's impossible to clone a\nrepository, either with https or ssh protocols. I've had to use a\n`gitg' GUI to clone such a repo.\n\n-- \nSebastian Gniazdowski\nNews: https://twitter.com/ZdharmaI\nIRC: https://kiwiirc.com/client/chat.freenode.net:+6697/#zplugin\nBlog: http://zdharma.org\n"},{"id":"382102","messageId":"xmqq5zm1i0xv.fsf@gitster-ct.c.googlers.com","threadId":"51819","inReplyTo":"CAKc7PVDT0JXCAW=aON2jXidCgib=SjoUXU6Yh4t+xWB8QW4NPQ@mail.gmail.com","subject":"Re: [BUG] Password cannot contain hash","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2019-09-09T22:01:32Z","receivedAt":"2019-09-09T22:01:37Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Sebastian Gniazdowski <sgniazdowski@gmail.com> writes:\n\n> Hello,\n> if the password contains a hash, then it's impossible to clone a\n> repository, either with https or ssh protocols. I've had to use a\n> `gitg' GUI to clone such a repo.\n\nHmph, do you mean that\n\n\tgit clone https://user:password@hosting.site/repository/\n\tgit clone ssh://user:password@hosting.site/repository/\n\nif the \"password\" has '#' in it?  Do passwords with colon, slash or\nat-sign have the same issue?  Would it help to URI escape the\nproblematic characters?\n\nIt is a separate issue to use passwords embedded in the URLs, but\nstill, escaping ought to work.\n\n\n        \n"},{"id":"382103","messageId":"20190909221501.GA31319@sigill.intra.peff.net","threadId":"51819","inReplyTo":"xmqq5zm1i0xv.fsf@gitster-ct.c.googlers.com","subject":"Re: [BUG] Password cannot contain hash","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2019-09-09T22:15:02Z","receivedAt":"2019-09-09T22:15:04Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Mon, Sep 09, 2019 at 03:01:32PM -0700, Junio C Hamano wrote:\n\n> Sebastian Gniazdowski <sgniazdowski@gmail.com> writes:\n> \n> > Hello,\n> > if the password contains a hash, then it's impossible to clone a\n> > repository, either with https or ssh protocols. I've had to use a\n> > `gitg' GUI to clone such a repo.\n> \n> Hmph, do you mean that\n> \n> \tgit clone https://user:password@hosting.site/repository/\n> \tgit clone ssh://user:password@hosting.site/repository/\n> \n> if the \"password\" has '#' in it?  Do passwords with colon, slash or\n> at-sign have the same issue?  Would it help to URI escape the\n> problematic characters?\n> \n> It is a separate issue to use passwords embedded in the URLs, but\n> still, escaping ought to work.\n\nIt does need escaped in a URL, or we complain. I wondered if we might be\nscrewing it up elsewhere in the code, too, but t5550 seems to pass with\nthe modification below.\n\ndiff --git a/t/lib-httpd.sh b/t/lib-httpd.sh\nindex 0d985758c6..a1bc0019c9 100644\n--- a/t/lib-httpd.sh\n+++ b/t/lib-httpd.sh\n@@ -154,7 +154,7 @@ prepare_httpd() {\n \tHTTPD_DEST=127.0.0.1:$LIB_HTTPD_PORT\n \tHTTPD_URL=$HTTPD_PROTO://$HTTPD_DEST\n \tHTTPD_URL_USER=$HTTPD_PROTO://user%40host@$HTTPD_DEST\n-\tHTTPD_URL_USER_PASS=$HTTPD_PROTO://user%40host:pass%40host@$HTTPD_DEST\n+\tHTTPD_URL_USER_PASS=$HTTPD_PROTO://user%40host:a%23hash@$HTTPD_DEST\n \n \tif test -n \"$LIB_HTTPD_DAV\" || test -n \"$LIB_HTTPD_SVN\"\n \tthen\ndiff --git a/t/lib-httpd/passwd b/t/lib-httpd/passwd\nindex 99a34d6487..636ba5b9eb 100644\n--- a/t/lib-httpd/passwd\n+++ b/t/lib-httpd/passwd\n@@ -1 +1 @@\n-user@host:xb4E8pqD81KQs\n+user@host:xgK/KkMxjf9xU\ndiff --git a/t/t5550-http-fetch-dumb.sh b/t/t5550-http-fetch-dumb.sh\nindex b811d89cfd..d1b64068e6 100755\n--- a/t/t5550-http-fetch-dumb.sh\n+++ b/t/t5550-http-fetch-dumb.sh\n@@ -65,13 +65,13 @@ test_expect_success 'http auth can use user/pass in URL' '\n '\n \n test_expect_success 'http auth can use just user in URL' '\n-\tset_askpass wrong pass@host &&\n+\tset_askpass wrong \"a#hash\" &&\n \tgit clone \"$HTTPD_URL_USER/auth/dumb/repo.git\" clone-auth-pass &&\n \texpect_askpass pass user@host\n '\n \n test_expect_success 'http auth can request both user and pass' '\n-\tset_askpass user@host pass@host &&\n+\tset_askpass user@host \"a#hash\" &&\n \tgit clone \"$HTTPD_URL/auth/dumb/repo.git\" clone-auth-both &&\n \texpect_askpass both user@host\n '\n@@ -80,7 +80,7 @@ test_expect_success 'http auth respects credential helper config' '\n \ttest_config_global credential.helper \"!f() {\n \t\tcat >/dev/null\n \t\techo username=user@host\n-\t\techo password=pass@host\n+\t\techo password=\"a#hash\"\n \t}; f\" &&\n \tset_askpass wrong &&\n \tgit clone \"$HTTPD_URL/auth/dumb/repo.git\" clone-auth-helper &&\n@@ -89,21 +89,21 @@ test_expect_success 'http auth respects credential helper config' '\n \n test_expect_success 'http auth can get username from config' '\n \ttest_config_global \"credential.$HTTPD_URL.username\" user@host &&\n-\tset_askpass wrong pass@host &&\n+\tset_askpass wrong \"a#hash\" &&\n \tgit clone \"$HTTPD_URL/auth/dumb/repo.git\" clone-auth-user &&\n \texpect_askpass pass user@host\n '\n \n test_expect_success 'configured username does not override URL' '\n \ttest_config_global \"credential.$HTTPD_URL.username\" wrong &&\n-\tset_askpass wrong pass@host &&\n+\tset_askpass wrong \"a#hash\" &&\n \tgit clone \"$HTTPD_URL_USER/auth/dumb/repo.git\" clone-auth-user2 &&\n \texpect_askpass pass user@host\n '\n \n test_expect_success 'set up repo with http submodules' '\n \tgit init super &&\n-\tset_askpass user@host pass@host &&\n+\tset_askpass user@host \"a#hash\" &&\n \t(\n \t\tcd super &&\n \t\tgit submodule add \"$HTTPD_URL/auth/dumb/repo.git\" sub &&\n@@ -112,21 +112,21 @@ test_expect_success 'set up repo with http submodules' '\n '\n \n test_expect_success 'cmdline credential config passes to submodule via clone' '\n-\tset_askpass wrong pass@host &&\n+\tset_askpass wrong \"a#hash\" &&\n \ttest_must_fail git clone --recursive super super-clone &&\n \trm -rf super-clone &&\n \n-\tset_askpass wrong pass@host &&\n+\tset_askpass wrong \"a#hash\" &&\n \tgit -c \"credential.$HTTPD_URL.username=user@host\" \\\n \t\tclone --recursive super super-clone &&\n \texpect_askpass pass user@host\n '\n \n test_expect_success 'cmdline credential config passes submodule via fetch' '\n-\tset_askpass wrong pass@host &&\n+\tset_askpass wrong \"a#hash\" &&\n \ttest_must_fail git -C super-clone fetch --recurse-submodules &&\n \n-\tset_askpass wrong pass@host &&\n+\tset_askpass wrong \"a#hash\" &&\n \tgit -C super-clone \\\n \t    -c \"credential.$HTTPD_URL.username=user@host\" \\\n \t    fetch --recurse-submodules &&\n@@ -140,10 +140,10 @@ test_expect_success 'cmdline credential config passes submodule update' '\n \tsha1=$(git rev-parse HEAD) &&\n \tgit -C super-clone update-index --cacheinfo 160000,$sha1,sub &&\n \n-\tset_askpass wrong pass@host &&\n+\tset_askpass wrong \"a#hash\" &&\n \ttest_must_fail git -C super-clone submodule update &&\n \n-\tset_askpass wrong pass@host &&\n+\tset_askpass wrong \"a#hash\" &&\n \tgit -C super-clone \\\n \t    -c \"credential.$HTTPD_URL.username=user@host\" \\\n \t    submodule update &&\n"}]}