Re: [PATCH/RFC] contrib: add win32 credential-helper

> On Fri, Mar 23, 2012 at 10:10 PM, Jeff King <peff@peff.net> wrote:
>> On Tue, Mar 20, 2012 at 12:06:54AM +0100, Erik Faye-Lund wrote:
>>
>>> This one pretty much sucks. Mem-leaks and a sketchy deletion-filter.
>>
>> Thanks for moving forward on this. I'm sorry I can't be much help on the
>> Windows-specific knowledge, but I'll answer what I can.
>>
>
> Thanks for following up :)
>
>>> Currently uses "::" as an attribute-separator, but this is not robust
>>> without encoding if the attribute values themselves contains "::".
>>
>> Yeah. Can you store arbitrary bytes? If so, NUL would be a good
>> terminator.
>
> No. TargetName is an LPWSTR, which is supposed to be zero-terminated.
> There's no way of specifying it's length directly.
>
>> Otherwise, newline is a reasonable choice, as the protocol
>> already can't communicate usernames/passwords with newlines (a
>> limitation that I accepted to make the protocol much simpler for
>> scripting use).
>>
>
> This works, but it causes Windows 7's credential manager to glitch in
> rendering the credential (adding all the newlines to the end of the
> line, and stretching an icon - yuck), which is also a bit unfortunate.
>
> So I'm thinking that escaping the string needs to be done. It can't be
> that big of a deal ;)
>