Skip to content

makeGitPassHelper may supply password as username. #81

@dmitshur

Description

@dmitshur

According to https://www.kernel.org/pub/software/scm/git/docs/gitcredentials.html:

Without any credential helpers defined, Git will try the following strategies to ask the user for usernames and passwords:

  1. If the GIT_ASKPASS environment variable is set, the program specified by the variable is invoked. A suitable prompt is provided to the program on the command line, and the user’s input is read from its standard output.

Emphasis mine.

If a username is not provided but a password is, it seems that using GIT_ASKPASS in the way that makeGitPassHelper does may arrange it to provide the password as username, and not provide any password, which would be desirable. We should prevent that from being possible.

/cc @neelance

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions