This Bugzilla instance is a read-only archive of historic NetBeans bug reports. To report a bug in NetBeans please follow the project's instructions for reporting issues.

Bug 225809 - Git HTTPS passwords stored with no meaningful key or description
Summary: Git HTTPS passwords stored with no meaningful key or description
Status: RESOLVED FIXED
Alias: None
Product: versioncontrol
Classification: Unclassified
Component: Git (show other bugs)
Version: 7.4
Hardware: PC Linux
: P4 normal (vote)
Assignee: Ondrej Vrabec
URL:
Keywords: PATCH_AVAILABLE
Depends on:
Blocks:
 
Reported: 2013-02-06 16:42 UTC by Jesse Glick
Modified: 2013-05-30 01:37 UTC (History)
1 user (show)

See Also:
Issue Type: DEFECT
Exception Reporter:


Attachments
Same patch, w/ MQ headers (898 bytes, patch)
2013-02-06 16:44 UTC, Jesse Glick
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jesse Glick 2013-02-06 16:42:36 UTC
I cloned a Git repository using HTTPS and agreed to save my password. But when I look for it in seahorse, it is difficult to find: there is a long list of keys named guri_password12:34:de:ad:be:ef:… or whatever, with no clear way to tell what site they are from.

Nicest would be to use the original key with unsafe characters escaped or translated to '_', so that the site appears in the seahorse key list, but if you are going to use a hash then please at least show this information in the description:

diff --git a/versioning.util/src/org/netbeans/modules/versioning/util/KeyringSupport.java b/versioning.util/src/org/netbeans/modules/versioning/util/KeyringSupport.java
--- a/versioning.util/src/org/netbeans/modules/versioning/util/KeyringSupport.java
+++ b/versioning.util/src/org/netbeans/modules/versioning/util/KeyringSupport.java
@@ -71,6 +71,9 @@
             }
             Keyring.delete(getKeyringKey(keyPrefix, key));
         } else {
+            if (description == null) {
+                description = key;
+            }
             if (LOG.isLoggable(Level.FINE)) {
                 LOG.log(Level.FINE, "Saving password for {0}:{1}", new String[] {keyPrefix, key}); //NOI18N
                 if (PRINT_PASSWORDS) {
Comment 1 Jesse Glick 2013-02-06 16:44:18 UTC
Created attachment 131068 [details]
Same patch, w/ MQ headers
Comment 2 Ondrej Vrabec 2013-02-06 17:07:01 UTC
> Nicest would be to use the original key with unsafe characters escaped or
> translated to '_', so that the site appears in the seahorse key list
I am not sure what the unsafe characters are/could be in case of different keyring storage implementations (on Mac, KDE, Gnome etc.). So the safest way seemed to use a hash as a key. Do you have any idea what characters can and what cannot be used in a key?
Comment 3 Jesse Glick 2013-02-06 18:13:33 UTC
KeyringProviderTestBase checks usage of exotic Unicode characters in keys, passwords, and descriptions, across providers.

FWIW HudsonManagerImpl.simplifyServerLocation does a simple substitution for readability but does not try to escape arbitrary characters; at least in this case you are only starting with characters permitted in URLs anyway.
Comment 4 Ondrej Vrabec 2013-02-26 16:55:51 UTC
i applied your patch: core-main #52791f2d7d25. I'll take a look and try to fix it properly later
Comment 5 Quality Engineering 2013-02-27 16:11:19 UTC
Integrated into 'main-golden', will be available in build *201302270948* on http://bits.netbeans.org/dev/nightly/ (upload may still be in progress)
Changeset: http://hg.netbeans.org/main-golden/rev/52791f2d7d25
User: Jesse Glick <jglick@netbeans.org>
Log: #225809: show description for SCM keyring entries.
Comment 6 Ondrej Vrabec 2013-05-29 10:01:37 UTC
fix: http://hg.netbeans.org/core-main/rev/53c16107b691
Comment 7 Quality Engineering 2013-05-30 01:37:42 UTC
Integrated into 'main-golden', will be available in build *201305292301* on http://bits.netbeans.org/dev/nightly/ (upload may still be in progress)
Changeset: http://hg.netbeans.org/main-golden/rev/53c16107b691
User: Ondrej Vrabec <ovrabec@netbeans.org>
Log: #225809 - Git HTTPS passwords stored with no meaningful key or description