From: Jeff King <peff@peff.net>
Date: Thu, 05 Jun 2025 08:00:02 GMT
Subject: Re: [PATCH v12 02/10] imap-send: add support for OAuth2.0 authentication
Message-ID: <20250605080002.GA2998537@coredump.intra.peff.net>
In-Reply-To: <PN3PR01MB9597D1C148578224A02B9773B862A@PN3PR01MB9597.INDPRD01.PROD.OUTLOOK.COM>

On Mon, Jun 02, 2025 at 04:29:33PM +0530, Aditya Garg wrote:

> @@ -1405,7 +1558,11 @@ static CURL *setup_curl(struct imap_server_conf *srvc, struct credential *cred)
>  
>  	server_fill_credential(srvc, cred);
>  	curl_easy_setopt(curl, CURLOPT_USERNAME, srvc->user);
> -	curl_easy_setopt(curl, CURLOPT_PASSWORD, srvc->pass);
> +
> +	if (!srvc->auth_method ||
> +	    strcmp(srvc->auth_method, "XOAUTH2") ||
> +	    strcmp(srvc->auth_method, "OAUTHBEARER"))
> +		curl_easy_setopt(curl, CURLOPT_PASSWORD, srvc->pass);

Coverity complains that this "if" will always be true, since one of the
strcmp() calls must return non-zero (srvc->auth_method cannot match both
strings!).

I'm not sure what the logic is supposed to be here. If we are matching
either string, it should be !strcmp() for both. If we want to match
neither, then it should be &&, not ||.

-Peff