rjgoyln commented on code in PR #64105:
URL: https://github.com/apache/airflow/pull/64105#discussion_r3951201655
##########
providers/git/src/airflow/providers/git/hooks/git.py:
##########
@@ -293,22 +293,48 @@ def _github_app_askpass_env(self) -> Generator[None]:
self.env["GIT_TERMINAL_PROMPT"] = old_terminal_prompt
os.environ["GIT_TERMINAL_PROMPT"] = old_terminal_prompt
- def _process_git_auth_url(self) -> None:
- if not isinstance(self.repo_url, str):
+ @contextlib.contextmanager
+ def _token_askpass_env(self):
+ """Hand the token to git through GIT_ASKPASS so it never reaches the
repo URL."""
+ # Only http(s) consults GIT_ASKPASS, so writing the token to a temp
script for an SSH
+ # connection that happens to carry one would put it on disk for
nothing.
+ if not self.auth_token or not
str(self.repo_url).startswith(("http://";, "https://";)):
+ yield
return
- if self.auth_token and self.repo_url.startswith("https://";):
- encoded_user = urlquote(self.user_name, safe="")
- encoded_token = urlquote(self.auth_token, safe="")
- self.repo_url = self.repo_url.replace("https://";,
f"https://{encoded_user}:{encoded_token}@";, 1)
- elif self.auth_token and self.repo_url.startswith("http://";):
- encoded_user = urlquote(self.user_name, safe="")
- encoded_token = urlquote(self.auth_token, safe="")
- self.repo_url = self.repo_url.replace("http://";,
f"http://{encoded_user}:{encoded_token}@";, 1)
- elif self.repo_url.startswith("http://";):
- # if no auth token, use the repo url as is
- pass
- elif not self.repo_url.startswith("git@") and not
self.repo_url.startswith("https://";):
- self.repo_url = os.path.expanduser(self.repo_url)
+
+ username = shlex.quote(self.user_name)
+ password = shlex.quote(self.auth_token)
+
+ with tempfile.NamedTemporaryFile(mode="w", suffix=".sh", delete=True)
as askpass_script:
+ askpass_script.write(
+ f"""#!/bin/sh
+case "$1" in
+ *Username*) echo {username} ;;
+ *Password*) echo {password} ;;
+ *) exit 1 ;;
+esac
Review Comment:
Thanks for pointing this out. I agree that the askpass helper should
validate the target host before returning the credential.
Fixed in 04c3313. The helper now validates the host from Git's prompt and
only returns the credential for the repository host, rejecting cross-origin
submodules.
I also added tests covering the supported Git prompt formats and
cross-origin cases.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
