git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [RFC PATCH] credential: minor documentation fixes

From
Jeff King <peff@peff.net>
Date
May 4, 2020, 16:10 UTC
Message-ID
<20200504161048.GC12842@coredump.intra.peff.net>
In-Reply-To
<20200504153957.GC86805@Carlos-MBP>
On Mon, May 04, 2020 at 08:39:57AM -0700, Carlo Marcelo Arenas Belón wrote:
Show 20 quoted lines
> On Mon, May 04, 2020 at 10:44:36AM -0400, Jeff King wrote:
> > On Mon, May 04, 2020 at 12:45:20AM -0700, Carlo Marcelo Arenas Belón wrote:
> > > 
> > > * the meaning of "exactly" for matching protocol and hostname in the URL
> > >   since 06 are both case insensitive per RFC3986 and we have been
> > >   ambiguous on that, leading to some helpers assuming case or encoding.
> > 
> > Yeah, IIRC we discussed case-sensitivity at the time and went with the
> > stricter behavior in the name of safety over convenience. And I don't
> > think anybody has complained since then. So I'm not really _opposed_ to
> > loosening it to match the URL, but perhaps a maintenance release is not
> > the best time to do so.
> 
> agree, but I was talking not in the context of a feature, but on how we
> are to define the interaction with helpers (which was meant to be part of
> this maintenance release).
> 
> currently (since it is undefined) a naive helper could do a caseless match
> by assuming we really meant url as defined by RFC3986, and therefore affect
> the wrong credential by the operation.

Right, I understand. But if helpers are doing case-insensitive matches, I don't think that's a big deal security-wise. And if we're not for our helpers, that's erring on the conservative side, but if nobody is complaining about it, I don't think it's urgent.

-Peff
Previous: Carlo Marcelo Arenas BelónNext: Carlo Marcelo Arenas Belón
Message 6 of 29 in “credential: minor documentation fixes”
  1. credential: minor documentation fixesCarlo Marcelo Arenas Belón, May 3, 2020
  2. Jeff KingMay 3, 2020
  3. Carlo Marcelo Arenas BelónMay 4, 2020
  4. Jeff KingMay 4, 2020
  5. Carlo Marcelo Arenas BelónMay 4, 2020
  6. Jeff KingMay 4, 2020
  7. Carlo Marcelo Arenas BelónMay 4, 2020
  8. Jeff KingMay 4, 2020
  9. 0/4 credential: documentation updates for maintCarlo Marcelo Arenas Belón, May 5, 2020
  10. 1/4 credential: update description for credential_from_url_gentlyCarlo Marcelo Arenas Belón, May 5, 2020
  11. 2/4 credential: correct order of parameters for credential_matchCarlo Marcelo Arenas Belón, May 5, 2020
  12. 4/4 credential: document protocol updatesCarlo Marcelo Arenas Belón, May 5, 2020
  13. Jeff KingMay 6, 2020
  14. 3/4 credential: update gitcredentials documentationCarlo Marcelo Arenas Belón, May 5, 2020
  15. Jeff KingMay 6, 2020
  16. Jeff KingMay 6, 2020
  17. Carlo Marcelo Arenas BelónMay 6, 2020
  18. Jeff KingMay 7, 2020
  19. Carlo Marcelo Arenas BelónMay 7, 2020
  20. Jeff KingMay 7, 2020
  21. Carlo Marcelo Arenas BelónMay 7, 2020
  22. 0/4 credential: documentation updates for maintCarlo Marcelo Arenas Belón, May 6, 2020
  23. 1/4 credential: update description for credential_from_url_gentlyCarlo Marcelo Arenas Belón, May 6, 2020
  24. 2/4 credential: correct order of parameters for credential_matchCarlo Marcelo Arenas Belón, May 6, 2020
  25. 3/4 credential: update gitcredentials documentationCarlo Marcelo Arenas Belón, May 6, 2020
  26. Jeff KingMay 7, 2020
  27. Junio C HamanoMay 7, 2020
  28. 4/4 credential: document protocol updatesCarlo Marcelo Arenas Belón, May 6, 2020
  29. Jeff KingMay 7, 2020

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.