kernel
/
git
mirror of https://git.kernel.org/pub/scm/git/git.git
1
0
Fork 0
Code Releases Activity

credential: document protocol updates 

Document protocol changes after CVE-2020-11008, including the removal of
references to the override of attributes which is no longer recommended
after CVE-2020-5260 and that might be removed in the future.

While at it do some improvements for clarity and consistency.

Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
maint
Carlo Marcelo Arenas Belón 2020-05-06 14:47:26 -07:00 committed by Junio C Hamano
parent 4b8938be4c
commit 1aed817f99
1 changed files with 21 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
Documentation/git-credential.txt
View File

@ -103,17 +103,20 @@ INPUT/OUTPUT FORMAT
`git credential` reads and/or writes (depending on the action used) `git credential` reads and/or writes (depending on the action used)
credential information in its standard input/output. This information credential information in its standard input/output. This information
can correspond either to keys for which `git credential` will obtain can correspond either to keys for which `git credential` will obtain
the login/password information (e.g. host, protocol, path), or to the the login information (e.g. host, protocol, path), or to the actual
actual credential data to be obtained (login/password). credential data to be obtained (username/password).


The credential is split into a set of named attributes, with one The credential is split into a set of named attributes, with one
attribute per line. Each attribute is attribute per line. Each attribute is specified by a key-value pair,
specified by a key-value pair, separated by an `=` (equals) sign, separated by an `=` (equals) sign, followed by a newline.
followed by a newline. The key may contain any bytes except `=`,
newline, or NUL. The value may contain any bytes except newline or NUL. The key may contain any bytes except `=`, newline, or NUL. The value may
contain any bytes except newline or NUL.

In both cases, all bytes are treated as-is (i.e., there is no quoting, In both cases, all bytes are treated as-is (i.e., there is no quoting,
and one cannot transmit a value with newline or NUL in it). The list of and one cannot transmit a value with newline or NUL in it). The list of
attributes is terminated by a blank line or end-of-file. attributes is terminated by a blank line or end-of-file.

Git understands the following attributes: Git understands the following attributes:


`protocol`:: `protocol`::
@ -123,7 +126,8 @@ Git understands the following attributes:


`host`:: `host`::


The remote hostname for a network credential. The remote hostname for a network credential. This includes
the port number if one was specified (e.g., "example.com:8088").


`path`:: `path`::


@ -134,7 +138,7 @@ Git understands the following attributes:
`username`:: `username`::


The credential's username, if we already have one (e.g., from a The credential's username, if we already have one (e.g., from a
URL, from the user, or from a previously run helper). URL, the configuration, the user, or from a previously run helper).


`password`:: `password`::


@ -146,8 +150,12 @@ Git understands the following attributes:
value is parsed as a URL and treated as if its constituent parts value is parsed as a URL and treated as if its constituent parts
were read (e.g., `url=https://example.com` would behave as if were read (e.g., `url=https://example.com` would behave as if
`protocol=https` and `host=example.com` had been provided). This `protocol=https` and `host=example.com` had been provided). This
can help callers avoid parsing URLs themselves. Note that any can help callers avoid parsing URLs themselves.
components which are missing from the URL (e.g., there is no
username in the example above) will be set to empty; if you want Note that specifying a protocol is mandatory and if the URL
to provide a URL and override some attributes, provide the URL doesn't specify a hostname (e.g., "cert:///path/to/file") the
attribute first, followed by any overrides. credential will contain a hostname attribute whose value is an
empty string.

Components which are missing from the URL (e.g., there is no
username in the example above) will be left unset.