search

sourcegraph / go-vcs

manipulate and inspect VCS repositories in Go
https://sourcegraph.com/sourcegraph/go-vcs
Other
79 stars 20 forks source link

makeGitPassHelper may supply password as username. #81

Open dmitshur opened 9 years ago

dmitshur commented 9 years ago

According to https://www.kernel.org/pub/software/scm/git/docs/gitcredentials.html:

Without any credential helpers defined, Git will try the following strategies to ask the user for usernames and passwords:

  1. If the GIT_ASKPASS environment variable is set, the program specified by the variable is invoked. A suitable prompt is provided to the program on the command line, and the user’s input is read from its standard output.

Emphasis mine.

If a username is not provided but a password is, it seems that using GIT_ASKPASS in the way that makeGitPassHelper does may arrange it to provide the password as username, and not provide any password, which would be desirable. We should prevent that from being possible.

/cc @neelance