-
-
Notifications
You must be signed in to change notification settings - Fork 175
Open
Description
Describe the bug
The WinVaultKeyring backend does not always accept case-insensitive usernames, even when Win32Cred does.
The following function causes this inconsistency:
keyring/keyring/backends/Windows.py
Lines 102 to 110 in 38c0401
| def _resolve_credential( | |
| self, service: str, username: str | None | |
| ) -> DecodingCredential | None: | |
| # first attempt to get the password under the service name | |
| res = self._read_credential(service) | |
| if not res or username and res['UserName'] != username: | |
| # It wasn't found so attempt to get it with the compound name | |
| res = self._read_credential(self._compound_name(username, service)) | |
| return res |
The code checks if the service exists in the Windows Credential Locker with an exact, case-sensitive match of the username (res['UserName'] != username). If it's not found, either because it doesn't exist or because the casing is different, it looks up the compound name {username}@{service}, which completely skips username comparison.
To Reproduce
> keyring set test USER
Password for 'USER' in 'test':
> keyring get test USER
PASS
> keyring get test user
> keyring set test user
Password for 'user' in 'test':
> keyring get test user
pass
> keyring get test USER
PASS
> keyring get test usER
PASS
> keyring set test usER
Password for 'usER' in 'test':
> keyring get test usER
paSS
> keyring get test USER
pass
> keyring get test user
passExpected behavior
WinVaultKeyring should use consistent case sensitivity.
Environment
- OS: Windows
> pip list | Select-String "keyring"
keyring 25.7.0
> keyring --list-backends
keyring.backends.chainer.ChainerBackend (priority: -1)
keyring.backends.fail.Keyring (priority: 0)
keyring.backends.Windows.WinVaultKeyring (priority: 5)
Metadata
Metadata
Assignees
Labels
No labels