git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 2/2] http, imap-send: stop using CURLOPT_VERBOSE

From
brian m. carlson <sandals@crustytoothpaste.net>
Date
May 12, 2020, 23:13 UTC
Message-ID
<20200512231331.GA6605@camp.crustytoothpaste.net>
In-Reply-To
<1df9e9deb7831b32694ea453759bf5d21952e165.1589218693.git.jonathantanmy@google.com>
On 2020-05-11 at 17:43:10, Jonathan Tan wrote:
Show 7 quoted lines
> Whenever GIT_CURL_VERBOSE is set, teach Git to behave as if
> GIT_TRACE_CURL=1 and GIT_TRACE_CURL_NO_DATA=1 is set, instead of setting
> CURLOPT_VERBOSE.
> 
> This is to prevent inadvertent revelation of sensitive data. In
> particular, GIT_CURL_VERBOSE redacts neither the "Authorization" header
> nor any cookies specified by GIT_REDACT_COOKIES.

I actually use GIT_CURL_VERBOSE to debug authentication problems from time to time, so I'd like to keep an option to produce full, unredacted output. Since everyone uses HTTPS, it's not possible to perform this debugging using a tool like Wireshark unless you use a MITM CA cert, which seems excessive.

-- 
brian m. carlson: Houston, Texas, US
OpenPGP: https://keybase.io/bk2204
Previous: Jeff KingNext: Junio C Hamano
Message 8 of 21 in “Safer GIT_CURL_VERBOSE”
  1. 0/2 Safer GIT_CURL_VERBOSEJonathan Tan, May 11, 2020
  2. 1/2 t5551: test that GIT_TRACE_CURL redacts passwordJonathan Tan, May 11, 2020
  3. Jeff KingMay 12, 2020
  4. 2/2 http, imap-send: stop using CURLOPT_VERBOSEJonathan Tan, May 11, 2020
  5. Jeff KingMay 12, 2020
  6. Jonathan TanMay 12, 2020
  7. Jeff KingMay 12, 2020
  8. brian m. carlsonMay 12, 2020
  9. Junio C HamanoMay 13, 2020
  10. Jeff KingMay 13, 2020
  11. Junio C HamanoMay 13, 2020
  12. Daniel StenbergMay 13, 2020
  13. Jeff KingMay 13, 2020
  14. 0/3 Safer GIT_CURL_VERBOSEJonathan Tan, May 13, 2020
  15. 2/3 http: make GIT_TRACE_CURL auth redaction optionalJonathan Tan, May 13, 2020
  16. Junio C HamanoMay 13, 2020
  17. 1/3 t5551: test that GIT_TRACE_CURL redacts passwordJonathan Tan, May 13, 2020
  18. 3/3 http, imap-send: stop using CURLOPT_VERBOSEJonathan Tan, May 13, 2020
  19. Junio C HamanoMay 13, 2020
  20. Junio C HamanoMay 13, 2020
  21. Jeff KingMay 15, 2020

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.