Re: [PATCH] netrc: only remove backslash when we have quotes

[Tim Rühsen]

After looking further into this, I added a new unit test function for 
parse_netrc_fp().

In short:
- \ always escapes the next character.
- that means, \ in a password needs to be escaped using \\

This also means that we don't have to change code.

We have to communicate better that backslashes do escape the next 
character and that double quotes are needed for tokens with spaces.
But I am not sure where exactly the best place is.

Regards, Tim

On 13.02.22 14:33, Tim Rühsen wrote:
> One thing is that different programs/parsers handle this differently, 
> because there is no standardization for the .netrc file.
> Some support spaces inside tokens, some not.
>
> The quotation mark is a wget extension to allow spaces and tabs inside a 
> token. That means quotation marks inside the token *could* be escaped by 
> a \ character (we don't really need that, but it seems to be the most 
> intuitive way).
>
> A simple rule like "never escape characters in .netrc" is the most 
> simple. If a password starts with ", the last character of the token mu
>
> So this patch is not correct as
> "a\b" is translated into a, while a\b would be correct.
>
> Here are some test cases that we can use
>
> "a\b" -> a\b
> a\b -> a\b
> "a\"b" -> a"b
> a"b -> a"b
> a\\b -> a\\b
> "a\\" -> a\\
> "a\\" -> a\\
> "a b" -> a b
>
> WDYT ?
>
> Regards, Tim
>
> On 11.02.22 17:38, Darshit Shah wrote:
> > Hi,
> >
> > Thanks a lot for the patch! Would you be willing to write a test case 
> > for it? The tests are  available in the testenv/ directory
> >
> > On Fri, Feb 11, 2022, at 12:28, Jose Quaresma wrote:
> > > If the netrc have backslash char "\" it doesn't work with "wget"
> > > but the same netrc file works with "curl -n"
> > >
> > > - For example if the netrc password have a backslash on it the wget 
> > > will return:
> > >    Username/Password Authentication Failed.
> > >
> > > - The same password with the backslash works if the it is typed on the
> > > stdin with:
> > >    wget uri --user=username --ask-password
> > >
> > > commit 2b2fd2924aa9eac8c831380196a13c427f6b4329, introduce quotation 
> > > mark
> > > support and after that wget will remove the backslash char in every 
> > > token
> > > on the netrc. The backslash can be removed but only when the presence of
> > > the quotation mark is detected.
> > >
> > > Signed-off-by: Jose Quaresma <quaresma.jose@gmail.com>
> > > ---
> > >   src/netrc.c | 2 +-
> > >   1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/src/netrc.c b/src/netrc.c
> > > index 76e52485..ab090256 100644
> > > --- a/src/netrc.c
> > > +++ b/src/netrc.c
> > > @@ -294,7 +294,7 @@ parse_netrc_fp (const char *path, FILE *fp)
> > >
> > >             /* Find the end of the token, handling quotes and 
> > > escapes.  */
> > >             while (*p && (qmark ? *p != '"' : !c_isspace (*p))){
> > > -            if (*p == '\\')
> > > +            if (qmark && *p == '\\')
> > >                 shift_left (p);
> > >               p ++;
> > >             }
> > > --
> > > 2.35.1

OpenPGP_signature
Description: OpenPGP digital signature