From: Taylor Blau <me@ttaylorr.com>
Date: Fri, 05 May 2023 17:46:16 GMT
Subject: Re: [PATCH 0/7] contrib/credential: avoid protocol injection attacks
Message-ID: <ZFVA6MyjUE+L+x9P@nand.local>
In-Reply-To: <bd745f48-038f-f4f2-2041-f4b2c7bd0d20@github.com>

On Fri, May 05, 2023 at 11:24:44AM -0400, Derrick Stolee wrote:
> > But the new "wwwauth[]" field does allow this attack to take place.
>
> In particular, because this should be resolved before 2.41.0-rc0.

Yes, definitely.

> Each patch was simple to read and well-motivated. I was particularly
> happy with this diffstat:
>
> >  contrib/credential/gnome-keyring/.gitignore   |   1 -
> >  contrib/credential/gnome-keyring/Makefile     |  25 -
> >  .../git-credential-gnome-keyring.c            | 470 ------------------
>
> The rest of the changes looked to be obvious improvements, so this
> v1 LGTM.

Thanks. Much credit is owed to Peff, who worked on these patches with
me. And FWIW, dropping support for the gnome-keyring helper was his
idea.

Thanks for the review :-).

Thanks,
Taylor