@matheusbsbs / matheus-bagliano / commits / 4a169da280

fetch doc: note "pushurl" caveat about "credentialsInUrl", elaborate

Amend the documentation and release notes entry for the "fetch.credentialsInUrl" feature added in 6dcbdc0d661 (remote: create fetch.credentialsInUrl config, 2022-06-06), it currently doesn't detect passwords in `remote.<name>.pushurl` configuration. We shouldn't lull users into a false sense of security, so we need to mention that prominently. This also elaborates and clarifies the "exposes the password in multiple ways" part of the documentation. As noted in [1] a user unfamiliar with git's implementation won't know what to make of that scary claim, e.g. git hypothetically have novel git-specific ways of exposing configured credentials. The reality is that this configuration is intended as an aid for users who can't fully trust their OS's or system's security model, so lets say that's what this is intended for, and mention the most common ways passwords stored in configuration might inadvertently get exposed. 1. https://lore.kernel.org/git/220524.86ilpuvcqh.gmgdl@evledraar.gmail.com/ Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com> Acked-by: Derrick Stolee <derrickstolee@github.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Ævar Arnfjörð Bjarmason committed Jun 15, 2022 at 12:44 UTC 4a169da280aa6d22bdf0cf5baea65f47bd363a3a
2 files changed +31 -7
Documentation/RelNotes/2.37.0.txt
+3 -1
@@ -55,7 +55,9 @@ UI, Workflows & Features
55 * Update the doctype written in gitweb output to xhtml5.
56
57 * The "fetch.credentialsInUrl" configuration variable controls what
58 - happens when a URL with embedded login credential is used.
58 + happens when a URL with embedded login credential is used on either
59 + "fetch" or "push". Credentials are currently only detected in
60 + `remote.<name>.url` config, not `remote.<name>.pushurl`.
61
62
63 Performance, Internal Implementation, Development Support etc.
Documentation/config/fetch.txt
+28 -6
@@ -98,12 +98,34 @@ fetch.writeCommitGraph::
98 `git push -f`, and `git log --graph`. Defaults to false.
99
100 fetch.credentialsInUrl::
101 - A URL can contain plaintext credentials in the form
102 - `<protocol>://<user>:<password>@<domain>/<path>`. Using such URLs
103 - is not recommended as it exposes the password in multiple ways,
104 - including Git storing the URL as plaintext in the repository config.
105 - The `fetch.credentialsInUrl` option provides instruction for how Git
106 - should react to seeing such a URL, with these values:
101 + A configured URL can contain plaintext credentials in the form
102 + `<protocol>://<user>:<password>@<domain>/<path>`. You may want
103 + to warn or forbid the use of such configuration (in favor of
104 + using linkgit:git-credential[1]).
105 ++
106 +Note that this is currently limited to detecting credentials in
107 +`remote.<name>.url` configuration, it won't detect credentials in
108 +`remote.<name>.pushurl` configuration.
109 ++
110 +You might want to enable this to prevent inadvertent credentials
111 +exposure, e.g. because:
112 ++
113 +* The OS or system where you're running git may not provide way way or
114 + otherwise allow you to configure the permissions of the
115 + configuration file where the username and/or password are stored.
116 +* Even if it does, having such data stored "at rest" might expose you
117 + in other ways, e.g. a backup process might copy the data to another
118 + system.
119 +* The git programs will pass the full URL to one another as arguments
120 + on the command-line, meaning the credentials will be exposed to oher
121 + users on OS's or systems that allow other users to see the full
122 + process list of other users. On linux the "hidepid" setting
123 + documented in procfs(5) allows for configuring this behavior.
124 ++
125 +If such concerns don't apply to you then you probably don't need to be
126 +concerned about credentials exposure due to storing that sensitive
127 +data in git's configuration files. If you do want to use this, set
128 +`fetch.credentialsInUrl` to one of these values:
129 +
130 * `allow` (default): Git will proceed with its activity without warning.
131 * `warn`: Git will write a warning message to `stderr` when parsing a URL