credential: handle `credential.<partial-URL>.<key>` again
In the patches for CVE-2020-11008, the ability to specify credential settings in the config for partial URLs got lost. For example, it used to be possible to specify a credential helper for a specific protocol: [credential "https://"] helper = my-https-helper Likewise, it used to be possible to configure settings for a specific host, e.g.: [credential "dev.azure.com"] useHTTPPath = true Let's reinstate this behavior. While at it, increase the test coverage to document and verify the behavior with a couple other categories of partial URLs. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Reviewed-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Johannes Schindelin committed
Apr 24, 2020 at 11:49 UTC
9a121b0d226dd0017318be0d18120aeb766f1235
2 files changed
+55
-1
credential.c
+17
-1
@@ -35,6 +35,10 @@ int credential_match(const struct credential *want,
35
#undef CHECK
36
}
37
38
+
39
+static int credential_from_potentially_partial_url(struct credential *c,
40
+ const char *url);
41
+
42
static int credential_config_callback(const char *var, const char *value,
43
void *data)
44
{
@@ -53,7 +57,13 @@ static int credential_config_callback(const char *var, const char *value,
57
char *url = xmemdupz(key, dot - key);
58
int matched;
59
56
- credential_from_url(&want, url);
60
+ if (credential_from_potentially_partial_url(&want, url) < 0) {
61
+ warning(_("skipping credential lookup for key: %s"),
62
+ var);
63
+ credential_clear(&want);
64
+ free(url);
65
+ return 0;
66
+ }
67
matched = credential_match(&want, c);
68
69
credential_clear(&want);
@@ -430,6 +440,12 @@ static int credential_from_url_1(struct credential *c, const char *url,
440
return 0;
441
}
442
443
+static int credential_from_potentially_partial_url(struct credential *c,
444
+ const char *url)
445
+{
446
+ return credential_from_url_1(c, url, 1, 0);
447
+}
448
+
449
int credential_from_url_gently(struct credential *c, const char *url, int quiet)
450
{
451
return credential_from_url_1(c, url, 0, quiet);
t/t0300-credentials.sh
+38
@@ -448,4 +448,42 @@ test_expect_success 'credential system refuses to work with missing protocol' '
448
test_i18ncmp expect stderr
449
'
450
451
+test_expect_success 'credential config with partial URLs' '
452
+ echo "echo password=yep" | write_script git-credential-yep &&
453
+ test_write_lines url=https://user@example.com/repo.git >stdin &&
454
+ for partial in \
455
+ example.com \
456
+ user@example.com \
457
+ https:// \
458
+ https://example.com \
459
+ https://example.com/ \
460
+ https://user@example.com \
461
+ https://user@example.com/ \
462
+ https://example.com/repo.git \
463
+ https://user@example.com/repo.git \
464
+ /repo.git
465
+ do
466
+ git -c credential.$partial.helper=yep \
467
+ credential fill <stdin >stdout &&
468
+ grep yep stdout ||
469
+ return 1
470
+ done &&
471
+
472
+ for partial in \
473
+ dont.use.this \
474
+ http:// \
475
+ /repo
476
+ do
477
+ git -c credential.$partial.helper=yep \
478
+ credential fill <stdin >stdout &&
479
+ ! grep yep stdout ||
480
+ return 1
481
+ done &&
482
+
483
+ git -c credential.$partial.helper=yep \
484
+ -c credential.with%0anewline.username=uh-oh \
485
+ credential fill <stdin >stdout 2>stderr &&
486
+ test_i18ngrep "skipping credential lookup for key" stderr
487
+'
488
+
489
test_done