Repository navigation
fog.man.reg: send the login as typed, and keep the password local - #201
Merged
Merged
Conversation
Review follow-ups to the fogLogin() change (#200): - Quote the value and encode it with printf. The bare `echo $password` split and globbed it, so a password holding '*', '?', a run of spaces, or spelled -n or -e reached the server changed, and a correct login read as invalid. `read -r` keeps a backslash. The tr joins base64's 76-column wrap for a long value. Leading and trailing blanks are still trimmed, as the web UI trims every posted value. - Declare username and password local, so the plaintext password does not outlive the function. - Say "registered without deploying an image" after a rejected deploy login, as the domain question already does. tests/checks/man-reg-login.sh cuts fogLogin() out of the script and drives it with a stubbed callServer. On the #200 version it fails on the glob expansion, the leaked password and username, and the wrapped long value. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Review of #200 found three problems in
fogLogin():echo $passwordsplit and globbed the value. A password holding*,?, a run of spaces, or spelled-nreached the server changed, and a correct login read as invalid.b*expanded to file names in the working directory.usernameandpasswordwere globals, so the plaintext password outlived the function.Fix
printf '%s' "$value" | base64 | tr -d '\n'.read -rkeeps a backslash. Leading and trailing blanks are still trimmed, as the web UI trims every posted value.usernameandpasswordlocal.Test
New
tests/checks/man-reg-login.shdrivesfogLogin()with a stubbedcallServer. It fails on the #200 version (glob expansion, leaked password and username, wrapped long value) and passes here.tests/run-all.sh: 33 passed, 0 failed.🤖 Generated with Claude Code