git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 0/7] contrib/credential: avoid protocol injection attacks

From
Taylor Blau <me@ttaylorr.com>
Date
May 5, 2023, 17:46 UTC
Message-ID
<ZFVA6MyjUE+L+x9P@nand.local>
In-Reply-To
<bd745f48-038f-f4f2-2041-f4b2c7bd0d20@github.com>
On Fri, May 05, 2023 at 11:24:44AM -0400, Derrick Stolee wrote:
> > But the new "wwwauth[]" field does allow this attack to take place.
>
> In particular, because this should be resolved before 2.41.0-rc0.
Yes, definitely.
Show 9 quoted lines
> Each patch was simple to read and well-motivated. I was particularly
> happy with this diffstat:
>
> >  contrib/credential/gnome-keyring/.gitignore   |   1 -
> >  contrib/credential/gnome-keyring/Makefile     |  25 -
> >  .../git-credential-gnome-keyring.c            | 470 ------------------
>
> The rest of the changes looked to be obvious improvements, so this
> v1 LGTM.

Thanks. Much credit is owed to Peff, who worked on these patches with me. And FWIW, dropping support for the gnome-keyring helper was his idea.

Thanks for the review :-).

Thanks, Taylor

Previous: Derrick Stolee
Message 10 of 10 in “contrib/credential: avoid protocol injection attacks”
  1. 0/7 contrib/credential: avoid protocol injection attacksTaylor Blau, May 1, 2023
  2. 1/7 credential.c: store "wwwauth[]" values in `credential_read()`Taylor Blau, May 1, 2023
  3. 2/7 t/lib-credential.sh: ensure credential helpers handle long headersTaylor Blau, May 1, 2023
  4. 3/7 contrib/credential: avoid fixed-size buffer in osxkeychainTaylor Blau, May 1, 2023
  5. 4/7 contrib/credential: remove 'gnome-keyring' credential helperTaylor Blau, May 1, 2023
  6. 5/7 contrib/credential: .gitignore libsecret build artifactsTaylor Blau, May 1, 2023
  7. 6/7 contrib/credential: avoid fixed-size buffer in libsecretTaylor Blau, May 1, 2023
  8. 7/7 contrib/credential: embiggen fixed-size buffer in wincredTaylor Blau, May 1, 2023
  9. Derrick StoleeMay 5, 2023
  10. Taylor BlauMay 5, 2023

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.