{"thread":{"id":"62788","subject":"Changing transfer.credentialsInUrl to default to \"warn\"","startedAt":"2025-01-11T07:15:04Z","lastAt":"2025-01-13T22:27:19Z","messageCount":5,"participants":["M Hickford","Junio C Hamano","Johannes Schindelin","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"510366","messageId":"20250111071500.710169-1-mirth.hickford@gmail.com","threadId":"62788","inReplyTo":null,"subject":"Changing transfer.credentialsInUrl to default to \"warn\"","fromName":"M Hickford","fromEmail":"mirth.hickford@gmail.com","sentAt":"2025-01-11T07:15:00Z","receivedAt":"2025-01-11T07:15:04Z","isPatch":false,"sender":{"key":"mirth.hickford@gmail.com","avatar":"https://avatars.githubusercontent.com/u/105314?v=4"},"body":"Including plaintext credentials in the remote URL risks inadvertent credentials exposure, as explained in docs https://git-scm.com/docs/git-config#Documentation/git-config.txt-transfercredentialsInUrl\n\nConfig key transfer.credentialsInUrl defaults to \"allow\", but if set to \"warn\", Git warns the user about plaintext credentials in the remote URL.\n\n $ git clone https://tim:hunter2@example.com/example.git\n warning: URL 'https://tim:@example.com/example.git' uses plaintext credentials\n\nIn order to nudge users towards more secure practices (namely, using a credential helper), would anyone else be in favour of changing transfer.credentialsInUrl to default to \"warn\"? \n\nhttps://github.com/git/git/commit/6dcbdc0d6616d7fbd2445aa2237b22e3c172ea85\n\n> This change currently defaults the behavior to \"allow\" which does \n> nothing with these URLs. We can consider changing this behavior to\n> \"warn\" by default if we wish. At that time, we may want to add some\n> advice about setting fetch.credentialsInUrl=ignore for users who still\n> want to follow this pattern (and not receive the warning).\n"},{"id":"510430","messageId":"xmqq1px6br7p.fsf@gitster.g","threadId":"62788","inReplyTo":"20250111071500.710169-1-mirth.hickford@gmail.com","subject":"Re: Changing transfer.credentialsInUrl to default to \"warn\"","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2025-01-13T16:42:34Z","receivedAt":"2025-01-13T16:42:37Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"M Hickford writes:\n\n> In order to nudge users towards more secure practices (namely,\n> using a credential helper), would anyone else be in favour of\n> changing transfer.credentialsInUrl to default to \"warn\"?\n\nI personally do not have a problem with the proposal, but it is\ncurious that it is documented as inspecting only .URL and .pushURL\nis not checked. So, in addition to \"once we start warning by\ndefault, we'd need an advice message to tell the users how to turn\nit off\" Derrick says in the commit log message, we would probably\nwant to see if we should/can cover .pushURL and need necessary updates\nbefore it happens.\n\nThanks.\n\n\n"},{"id":"510455","messageId":"7a60c9ec-8f98-73d3-4539-d96b63a4f442@gmx.de","threadId":"62788","inReplyTo":"xmqq1px6br7p.fsf@gitster.g","subject":"Re: Changing transfer.credentialsInUrl to default to \"warn\"","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2025-01-13T21:53:46Z","receivedAt":"2025-01-13T21:53:49Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi M & Junio,\n\nOn Mon, 13 Jan 2025, Junio C Hamano wrote:\n\n> M Hickford writes:\n>\n> > In order to nudge users towards more secure practices (namely, using a\n> > credential helper), would anyone else be in favour of changing\n> > transfer.credentialsInUrl to default to \"warn\"?\n\nIIRC that was the plan all along, and if the original Git Fundamentals\nteam (of which both Stolee and myself were members, and from which this\npatch originated) still existed, I believe that plan would have been\nturned into reality already.\n\nOr more clearly: Yes, this is a good idea.\n\n> I personally do not have a problem with the proposal, but it is curious\n> that it is documented as inspecting only .URL and .pushURL is not\n> checked. So, in addition to \"once we start warning by default, we'd\n> need an advice message to tell the users how to turn it off\" Derrick\n> says in the commit log message, we would probably want to see if we\n> should/can cover .pushURL and need necessary updates before it happens.\n\nThe reason why `.pushURL` was not handled as well is that it is way too\ncommon for Git users to call `git clone https://:@`\n(heck, I am privy to documentation that explicitly calls for this) and\nthose users typically do not realize that the credentials are then stored\nas plain text in their Git config (and prior to b7d49ac1ecd (trace2:\nredact passwords from https:// URLs by default, 2023-11-22) would even be\nlogged via Trace2).\n\nThere is no similar indirect way to leak credentials into `pushURL`; You\nreally have to set that config setting explicitly (or call something like\n`git remote set-url --push [...]`). It is much more obvious in those\ninstances that the verbatim credentials will be leaked into the config.\n\nHaving said that, I would be in favor of letting\n`transfer.credentialsInURL` treat `remote.*.pushURL` in the same manner as\n`remote.*.url`.\n\nCiao,\nJohannes\n"},{"id":"510456","messageId":"Z4WLsmq4rPEMnUXK@tapette.crustytoothpaste.net","threadId":"62788","inReplyTo":"xmqq1px6br7p.fsf@gitster.g","subject":"Re: Changing transfer.credentialsInUrl to default to \"warn\"","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2025-01-13T21:54:58Z","receivedAt":"2025-01-13T21:55:00Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2025-01-13 at 16:42:34, Junio C Hamano wrote:\n> M Hickford writes:\n> \n> > In order to nudge users towards more secure practices (namely,\n> > using a credential helper), would anyone else be in favour of\n> > changing transfer.credentialsInUrl to default to \"warn\"?\n> \n> I personally do not have a problem with the proposal, but it is\n> curious that it is documented as inspecting only .URL and .pushURL\n> is not checked. So, in addition to \"once we start warning by\n> default, we'd need an advice message to tell the users how to turn\n> it off\" Derrick says in the commit log message, we would probably\n> want to see if we should/can cover .pushURL and need necessary updates\n> before it happens.\n\nI agree.\n\nIt's not clear to me from the documentation if this only warns if\nthere's a password in the URL or also if there's just a username. (To\nme, the word \"credentials\" doesn't seem to explain that very well.) The\nformer I think is fine, the latter is not. Looking at the code, it\nappears it is the former, so that's good.\n\nPerhaps we should also clarify the documentation so that users can make\nan educated decision. I'll send a patch.\n-- \nbrian m. carlson (they/them or he/him)\nToronto, Ontario, CA\n"},{"id":"510458","messageId":"xmqq34hm8i4b.fsf@gitster.g","threadId":"62788","inReplyTo":"7a60c9ec-8f98-73d3-4539-d96b63a4f442@gmx.de","subject":"Re: Changing transfer.credentialsInUrl to default to \"warn\"","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2025-01-13T22:27:16Z","receivedAt":"2025-01-13T22:27:19Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Johannes Schindelin writes:\n\n> The reason why `.pushURL` was not handled as well is that it is way too\n> common for Git users to call `git clone https://:@`\n> ...\n> There is no similar indirect way to leak credentials into `pushURL`\n\nAh, so it is not primarily between .URL vs .pushURL, but the\ndifference is between \"clone\" that leaves the URL used on the\ncommand line in the configuraiton, vs \"push\" that does not.\n\nAnd because .pushURL has to be explicitly configured by the\nend-user, there is much less need to remind that they are _storing_\ncredential material in the configuration files.\n\nThe reasoning does make sense.\n\n> Having said that, I would be in favor of letting\n> `transfer.credentialsInURL` treat `remote.*.pushURL` in the same manner as\n> `remote.*.url`.\n\nAmen to that. Thanks.\n"}]}