t/t0300-credentials.sh

   1 #!/bin/sh
   2
   3 test_description='basic credential helper tests'
   4 . ./test-lib.sh
   5 . "$TEST_DIRECTORY"/lib-credential.sh
   6
   7 test_expect_success 'setup helper scripts' '
   8         cat >dump <<-\EOF &&
   9         whoami=$(echo $0 | sed s/.*git-credential-//)
  10         echo >&2 "$whoami: $*"
  11         OIFS=$IFS
  12         IFS==
  13         while read key value; do
  14                 echo >&2 "$whoami: $key=$value"
  15                 eval "$key=$value"
  16         done
  17         IFS=$OIFS
  18         EOF
  19
  20         write_script git-credential-useless <<-\EOF &&
  21         . ./dump
  22         exit 0
  23         EOF
  24
  25         write_script git-credential-quit <<-\EOF &&
  26         . ./dump
  27         echo quit=1
  28         EOF
  29
  30         write_script git-credential-verbatim <<-\EOF &&
  31         user=$1; shift
  32         pass=$1; shift
  33         . ./dump
  34         test -z "$user" || echo username=$user
  35         test -z "$pass" || echo password=$pass
  36         EOF
  37
  38         PATH="$PWD:$PATH"
  39 '
  40
  41 test_expect_success 'credential_fill invokes helper' '
  42         check fill "verbatim foo bar" <<-\EOF
  43         protocol=http
  44         host=example.com
  45         --
  46         protocol=http
  47         host=example.com
  48         username=foo
  49         password=bar
  50         --
  51         verbatim: get
  52         verbatim: protocol=http
  53         verbatim: host=example.com
  54         EOF
  55 '
  56
  57 test_expect_success 'credential_fill invokes multiple helpers' '
  58         check fill useless "verbatim foo bar" <<-\EOF
  59         protocol=http
  60         host=example.com
  61         --
  62         protocol=http
  63         host=example.com
  64         username=foo
  65         password=bar
  66         --
  67         useless: get
  68         useless: protocol=http
  69         useless: host=example.com
  70         verbatim: get
  71         verbatim: protocol=http
  72         verbatim: host=example.com
  73         EOF
  74 '
  75
  76 test_expect_success 'credential_fill stops when we get a full response' '
  77         check fill "verbatim one two" "verbatim three four" <<-\EOF
  78         protocol=http
  79         host=example.com
  80         --
  81         protocol=http
  82         host=example.com
  83         username=one
  84         password=two
  85         --
  86         verbatim: get
  87         verbatim: protocol=http
  88         verbatim: host=example.com
  89         EOF
  90 '
  91
  92 test_expect_success 'credential_fill continues through partial response' '
  93         check fill "verbatim one \"\"" "verbatim two three" <<-\EOF
  94         protocol=http
  95         host=example.com
  96         --
  97         protocol=http
  98         host=example.com
  99         username=two
 100         password=three
 101         --
 102         verbatim: get
 103         verbatim: protocol=http
 104         verbatim: host=example.com
 105         verbatim: get
 106         verbatim: protocol=http
 107         verbatim: host=example.com
 108         verbatim: username=one
 109         EOF
 110 '
 111
 112 test_expect_success 'credential_fill passes along metadata' '
 113         check fill "verbatim one two" <<-\EOF
 114         protocol=ftp
 115         host=example.com
 116         path=foo.git
 117         --
 118         protocol=ftp
 119         host=example.com
 120         path=foo.git
 121         username=one
 122         password=two
 123         --
 124         verbatim: get
 125         verbatim: protocol=ftp
 126         verbatim: host=example.com
 127         verbatim: path=foo.git
 128         EOF
 129 '
 130
 131 test_expect_success 'credential_approve calls all helpers' '
 132         check approve useless "verbatim one two" <<-\EOF
 133         protocol=http
 134         host=example.com
 135         username=foo
 136         password=bar
 137         --
 138         --
 139         useless: store
 140         useless: protocol=http
 141         useless: host=example.com
 142         useless: username=foo
 143         useless: password=bar
 144         verbatim: store
 145         verbatim: protocol=http
 146         verbatim: host=example.com
 147         verbatim: username=foo
 148         verbatim: password=bar
 149         EOF
 150 '
 151
 152 test_expect_success 'do not bother storing password-less credential' '
 153         check approve useless <<-\EOF
 154         protocol=http
 155         host=example.com
 156         username=foo
 157         --
 158         --
 159         EOF
 160 '
 161
 162
 163 test_expect_success 'credential_reject calls all helpers' '
 164         check reject useless "verbatim one two" <<-\EOF
 165         protocol=http
 166         host=example.com
 167         username=foo
 168         password=bar
 169         --
 170         --
 171         useless: erase
 172         useless: protocol=http
 173         useless: host=example.com
 174         useless: username=foo
 175         useless: password=bar
 176         verbatim: erase
 177         verbatim: protocol=http
 178         verbatim: host=example.com
 179         verbatim: username=foo
 180         verbatim: password=bar
 181         EOF
 182 '
 183
 184 test_expect_success 'usernames can be preserved' '
 185         check fill "verbatim \"\" three" <<-\EOF
 186         protocol=http
 187         host=example.com
 188         username=one
 189         --
 190         protocol=http
 191         host=example.com
 192         username=one
 193         password=three
 194         --
 195         verbatim: get
 196         verbatim: protocol=http
 197         verbatim: host=example.com
 198         verbatim: username=one
 199         EOF
 200 '
 201
 202 test_expect_success 'usernames can be overridden' '
 203         check fill "verbatim two three" <<-\EOF
 204         protocol=http
 205         host=example.com
 206         username=one
 207         --
 208         protocol=http
 209         host=example.com
 210         username=two
 211         password=three
 212         --
 213         verbatim: get
 214         verbatim: protocol=http
 215         verbatim: host=example.com
 216         verbatim: username=one
 217         EOF
 218 '
 219
 220 test_expect_success 'do not bother completing already-full credential' '
 221         check fill "verbatim three four" <<-\EOF
 222         protocol=http
 223         host=example.com
 224         username=one
 225         password=two
 226         --
 227         protocol=http
 228         host=example.com
 229         username=one
 230         password=two
 231         --
 232         EOF
 233 '
 234
 235 # We can't test the basic terminal password prompt here because
 236 # getpass() tries too hard to find the real terminal. But if our
 237 # askpass helper is run, we know the internal getpass is working.
 238 test_expect_success 'empty helper list falls back to internal getpass' '
 239         check fill <<-\EOF
 240         protocol=http
 241         host=example.com
 242         --
 243         protocol=http
 244         host=example.com
 245         username=askpass-username
 246         password=askpass-password
 247         --
 248         askpass: Username for '\''http://example.com'\'':
 249         askpass: Password for '\''http://askpass-username@example.com'\'':
 250         EOF
 251 '
 252
 253 test_expect_success 'internal getpass does not ask for known username' '
 254         check fill <<-\EOF
 255         protocol=http
 256         host=example.com
 257         username=foo
 258         --
 259         protocol=http
 260         host=example.com
 261         username=foo
 262         password=askpass-password
 263         --
 264         askpass: Password for '\''http://foo@example.com'\'':
 265         EOF
 266 '
 267
 268 test_expect_success 'git-credential respects core.askPass' '
 269         write_script alternate-askpass <<-\EOF &&
 270         echo >&2 "alternate askpass invoked"
 271         echo alternate-value
 272         EOF
 273         test_config core.askpass "$PWD/alternate-askpass" &&
 274         (
 275                 # unset GIT_ASKPASS set by lib-credential.sh which would
 276                 # override our config, but do so in a subshell so that we do
 277                 # not interfere with other tests
 278                 sane_unset GIT_ASKPASS &&
 279                 check fill <<-\EOF
 280                 protocol=http
 281                 host=example.com
 282                 --
 283                 protocol=http
 284                 host=example.com
 285                 username=alternate-value
 286                 password=alternate-value
 287                 --
 288                 alternate askpass invoked
 289                 alternate askpass invoked
 290                 EOF
 291         )
 292 '
 293
 294 HELPER="!f() {
 295                 cat >/dev/null
 296                 echo username=foo
 297                 echo password=bar
 298         }; f"
 299 test_expect_success 'respect configured credentials' '
 300         test_config credential.helper "$HELPER" &&
 301         check fill <<-\EOF
 302         protocol=http
 303         host=example.com
 304         --
 305         protocol=http
 306         host=example.com
 307         username=foo
 308         password=bar
 309         --
 310         EOF
 311 '
 312
 313 test_expect_success 'match configured credential' '
 314         test_config credential.https://example.com.helper "$HELPER" &&
 315         check fill <<-\EOF
 316         protocol=https
 317         host=example.com
 318         path=repo.git
 319         --
 320         protocol=https
 321         host=example.com
 322         username=foo
 323         password=bar
 324         --
 325         EOF
 326 '
 327
 328 test_expect_success 'do not match configured credential' '
 329         test_config credential.https://foo.helper "$HELPER" &&
 330         check fill <<-\EOF
 331         protocol=https
 332         host=bar
 333         --
 334         protocol=https
 335         host=bar
 336         username=askpass-username
 337         password=askpass-password
 338         --
 339         askpass: Username for '\''https://bar'\'':
 340         askpass: Password for '\''https://askpass-username@bar'\'':
 341         EOF
 342 '
 343
 344 test_expect_success 'match multiple configured helpers' '
 345         test_config credential.helper "verbatim \"\" \"\"" &&
 346         test_config credential.https://example.com.helper "$HELPER" &&
 347         check fill <<-\EOF
 348         protocol=https
 349         host=example.com
 350         path=repo.git
 351         --
 352         protocol=https
 353         host=example.com
 354         username=foo
 355         password=bar
 356         --
 357         verbatim: get
 358         verbatim: protocol=https
 359         verbatim: host=example.com
 360         EOF
 361 '
 362
 363 test_expect_success 'match multiple configured helpers with URLs' '
 364         test_config credential.https://example.com/repo.git.helper "verbatim \"\" \"\"" &&
 365         test_config credential.https://example.com.helper "$HELPER" &&
 366         check fill <<-\EOF
 367         protocol=https
 368         host=example.com
 369         path=repo.git
 370         --
 371         protocol=https
 372         host=example.com
 373         username=foo
 374         password=bar
 375         --
 376         verbatim: get
 377         verbatim: protocol=https
 378         verbatim: host=example.com
 379         EOF
 380 '
 381
 382 test_expect_success 'match percent-encoded values' '
 383         test_config credential.https://example.com/%2566.git.helper "$HELPER" &&
 384         check fill <<-\EOF
 385         url=https://example.com/%2566.git
 386         --
 387         protocol=https
 388         host=example.com
 389         username=foo
 390         password=bar
 391         --
 392         EOF
 393 '
 394
 395 test_expect_success 'match percent-encoded UTF-8 values in path' '
 396         test_config credential.https://example.com.useHttpPath true &&
 397         test_config credential.https://example.com/perú.git.helper "$HELPER" &&
 398         check fill <<-\EOF
 399         url=https://example.com/per%C3%BA.git
 400         --
 401         protocol=https
 402         host=example.com
 403         path=perú.git
 404         username=foo
 405         password=bar
 406         --
 407         EOF
 408 '
 409
 410 test_expect_success 'match percent-encoded values in username' '
 411         test_config credential.https://user%2fname@example.com/foo/bar.git.helper "$HELPER" &&
 412         check fill <<-\EOF
 413         url=https://user%2fname@example.com/foo/bar.git
 414         --
 415         protocol=https
 416         host=example.com
 417         username=foo
 418         password=bar
 419         --
 420         EOF
 421 '
 422
 423 test_expect_success 'fetch with multiple path components' '
 424         test_unconfig credential.helper &&
 425         test_config credential.https://example.com/foo/repo.git.helper "verbatim foo bar" &&
 426         check fill <<-\EOF
 427         url=https://example.com/foo/repo.git
 428         --
 429         protocol=https
 430         host=example.com
 431         username=foo
 432         password=bar
 433         --
 434         verbatim: get
 435         verbatim: protocol=https
 436         verbatim: host=example.com
 437         EOF
 438 '
 439
 440 test_expect_success 'pull username from config' '
 441         test_config credential.https://example.com.username foo &&
 442         check fill <<-\EOF
 443         protocol=https
 444         host=example.com
 445         --
 446         protocol=https
 447         host=example.com
 448         username=foo
 449         password=askpass-password
 450         --
 451         askpass: Password for '\''https://foo@example.com'\'':
 452         EOF
 453 '
 454
 455 test_expect_success 'honors username from URL over helper (URL)' '
 456         test_config credential.https://example.com.username bob &&
 457         test_config credential.https://example.com.helper "verbatim \"\" bar" &&
 458         check fill <<-\EOF
 459         url=https://alice@example.com
 460         --
 461         protocol=https
 462         host=example.com
 463         username=alice
 464         password=bar
 465         --
 466         verbatim: get
 467         verbatim: protocol=https
 468         verbatim: host=example.com
 469         verbatim: username=alice
 470         EOF
 471 '
 472
 473 test_expect_success 'honors username from URL over helper (components)' '
 474         test_config credential.https://example.com.username bob &&
 475         test_config credential.https://example.com.helper "verbatim \"\" bar" &&
 476         check fill <<-\EOF
 477         protocol=https
 478         host=example.com
 479         username=alice
 480         --
 481         protocol=https
 482         host=example.com
 483         username=alice
 484         password=bar
 485         --
 486         verbatim: get
 487         verbatim: protocol=https
 488         verbatim: host=example.com
 489         verbatim: username=alice
 490         EOF
 491 '
 492
 493 test_expect_success 'last matching username wins' '
 494         test_config credential.https://example.com/path.git.username bob &&
 495         test_config credential.https://example.com.username alice &&
 496         test_config credential.https://example.com.helper "verbatim \"\" bar" &&
 497         check fill <<-\EOF
 498         url=https://example.com/path.git
 499         --
 500         protocol=https
 501         host=example.com
 502         username=alice
 503         password=bar
 504         --
 505         verbatim: get
 506         verbatim: protocol=https
 507         verbatim: host=example.com
 508         verbatim: username=alice
 509         EOF
 510 '
 511
 512 test_expect_success 'http paths can be part of context' '
 513         check fill "verbatim foo bar" <<-\EOF &&
 514         protocol=https
 515         host=example.com
 516         path=foo.git
 517         --
 518         protocol=https
 519         host=example.com
 520         username=foo
 521         password=bar
 522         --
 523         verbatim: get
 524         verbatim: protocol=https
 525         verbatim: host=example.com
 526         EOF
 527         test_config credential.https://example.com.useHttpPath true &&
 528         check fill "verbatim foo bar" <<-\EOF
 529         protocol=https
 530         host=example.com
 531         path=foo.git
 532         --
 533         protocol=https
 534         host=example.com
 535         path=foo.git
 536         username=foo
 537         password=bar
 538         --
 539         verbatim: get
 540         verbatim: protocol=https
 541         verbatim: host=example.com
 542         verbatim: path=foo.git
 543         EOF
 544 '
 545
 546 test_expect_success 'context uses urlmatch' '
 547         test_config "credential.https://*.org.useHttpPath" true &&
 548         check fill "verbatim foo bar" <<-\EOF
 549         protocol=https
 550         host=example.org
 551         path=foo.git
 552         --
 553         protocol=https
 554         host=example.org
 555         path=foo.git
 556         username=foo
 557         password=bar
 558         --
 559         verbatim: get
 560         verbatim: protocol=https
 561         verbatim: host=example.org
 562         verbatim: path=foo.git
 563         EOF
 564 '
 565
 566 test_expect_success 'helpers can abort the process' '
 567         test_must_fail git \
 568                 -c credential.helper=quit \
 569                 -c credential.helper="verbatim foo bar" \
 570                 credential fill >stdout 2>stderr <<-\EOF &&
 571         protocol=http
 572         host=example.com
 573         EOF
 574         test_must_be_empty stdout &&
 575         cat >expect <<-\EOF &&
 576         quit: get
 577         quit: protocol=http
 578         quit: host=example.com
 579         fatal: credential helper '\''quit'\'' told us to quit
 580         EOF
 581         test_cmp expect stderr
 582 '
 583
 584 test_expect_success 'empty helper spec resets helper list' '
 585         test_config credential.helper "verbatim file file" &&
 586         check fill "" "verbatim cmdline cmdline" <<-\EOF
 587         protocol=http
 588         host=example.com
 589         --
 590         protocol=http
 591         host=example.com
 592         username=cmdline
 593         password=cmdline
 594         --
 595         verbatim: get
 596         verbatim: protocol=http
 597         verbatim: host=example.com
 598         EOF
 599 '
 600
 601 test_expect_success 'url parser rejects embedded newlines' '
 602         test_must_fail git credential fill 2>stderr <<-\EOF &&
 603         url=https://one.example.com?%0ahost=two.example.com/
 604         EOF
 605         cat >expect <<-\EOF &&
 606         warning: url contains a newline in its path component: https://one.example.com?%0ahost=two.example.com/
 607         fatal: credential url cannot be parsed: https://one.example.com?%0ahost=two.example.com/
 608         EOF
 609         test_cmp expect stderr
 610 '
 611
 612 test_expect_success 'host-less URLs are parsed as empty host' '
 613         check fill "verbatim foo bar" <<-\EOF
 614         url=cert:///path/to/cert.pem
 615         --
 616         protocol=cert
 617         host=
 618         path=path/to/cert.pem
 619         username=foo
 620         password=bar
 621         --
 622         verbatim: get
 623         verbatim: protocol=cert
 624         verbatim: host=
 625         verbatim: path=path/to/cert.pem
 626         EOF
 627 '
 628
 629 test_expect_success 'credential system refuses to work with missing host' '
 630         test_must_fail git credential fill 2>stderr <<-\EOF &&
 631         protocol=http
 632         EOF
 633         cat >expect <<-\EOF &&
 634         fatal: refusing to work with credential missing host field
 635         EOF
 636         test_cmp expect stderr
 637 '
 638
 639 test_expect_success 'credential system refuses to work with missing protocol' '
 640         test_must_fail git credential fill 2>stderr <<-\EOF &&
 641         host=example.com
 642         EOF
 643         cat >expect <<-\EOF &&
 644         fatal: refusing to work with credential missing protocol field
 645         EOF
 646         test_cmp expect stderr
 647 '
 648
 649 # usage: check_host_and_path <url> <expected-host> <expected-path>
 650 check_host_and_path () {
 651         # we always parse the path component, but we need this to make sure it
 652         # is passed to the helper
 653         test_config credential.useHTTPPath true &&
 654         check fill "verbatim user pass" <<-EOF
 655         url=$1
 656         --
 657         protocol=https
 658         host=$2
 659         path=$3
 660         username=user
 661         password=pass
 662         --
 663         verbatim: get
 664         verbatim: protocol=https
 665         verbatim: host=$2
 666         verbatim: path=$3
 667         EOF
 668 }
 669
 670 test_expect_success 'url parser handles bare query marker' '
 671         check_host_and_path https://example.com?foo.git example.com ?foo.git
 672 '
 673
 674 test_expect_success 'url parser handles bare fragment marker' '
 675         check_host_and_path https://example.com#foo.git example.com "#foo.git"
 676 '
 677
 678 test_expect_success 'url parser not confused by encoded markers' '
 679         check_host_and_path https://example.com%23%3f%2f/foo.git \
 680                 "example.com#?/" foo.git
 681 '
 682
 683 test_expect_success 'credential config with partial URLs' '
 684         echo "echo password=yep" | write_script git-credential-yep &&
 685         test_write_lines url=https://user@example.com/repo.git >stdin &&
 686         for partial in \
 687                 example.com \
 688                 user@example.com \
 689                 https:// \
 690                 https://example.com \
 691                 https://example.com/ \
 692                 https://user@example.com \
 693                 https://user@example.com/ \
 694                 https://example.com/repo.git \
 695                 https://user@example.com/repo.git \
 696                 /repo.git
 697         do
 698                 git -c credential.$partial.helper=yep \
 699                         credential fill <stdin >stdout &&
 700                 grep yep stdout ||
 701                 return 1
 702         done &&
 703
 704         for partial in \
 705                 dont.use.this \
 706                 http:// \
 707                 /repo
 708         do
 709                 git -c credential.$partial.helper=yep \
 710                         credential fill <stdin >stdout &&
 711                 ! grep yep stdout ||
 712                 return 1
 713         done &&
 714
 715         git -c credential.$partial.helper=yep \
 716                 -c credential.with%0anewline.username=uh-oh \
 717                 credential fill <stdin >stdout 2>stderr &&
 718         test_i18ngrep "skipping credential lookup for key" stderr
 719 '
 720
 721 test_done