Migration: Spawned git process includes username and password in cleartext #1786

New Issue

GiteaMirror · 2025-11-02T04:13:13-06:00

GiteaMirror commented

2025-11-02 04:13:13 -06:00

Originally created by @sebastian-sauer on GitHub (May 15, 2018).

Operating system: Debian 9.4
Gitea version (or commit ref): 1.4.1
Git version: 2.11.0
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist: << not needed >>

Description

When migrating a password protected repository via the migrate functionality git will be spawned on the command line with username & password in the remote url, resulting in processes visible with username & password in clear text.

For example (just one spawned process by git):

git fetch-pack --stateless-rpc --stdin --lock-pack --thin --check-self-contained-and-connected --cloning --no-progress https://user:password@remote-repo/git.git

Possible workaround: Use a temporary file to store the password & username and use core.askpass when spawning git processes (as jenkins and other CI tools do for example)

Originally created by @sebastian-sauer on GitHub (May 15, 2018).  - Operating system: Debian 9.4 - Gitea version (or commit ref): 1.4.1 - Git version: 2.11.0 - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [X] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [X] Not relevant - Log gist: << not needed >> ## Description When migrating a password protected repository via the migrate functionality git will be spawned on the command line with username & password in the remote url, resulting in processes visible with username & password in clear text. For example (just one spawned process by git): git fetch-pack --stateless-rpc --stdin --lock-pack --thin --check-self-contained-and-connected --cloning --no-progress https://user:password@remote-repo/git.git Possible workaround: Use a temporary file to store the password & username and use core.askpass when spawning git processes (as jenkins and other CI tools do for example)

GiteaMirror added the topic/security label 2025-11-02 04:13:13 -06:00

GiteaMirror closed this issue

2025-11-02 04:13:13 -06:00

GiteaMirror commented

2025-11-02 04:13:14 -06:00

@jonasfranz commented on GitHub (May 24, 2018):

I propose the following flow:

Create a .gitea-credentials file with read-write permissions in the gitea directory.
Save the credentials in the following format: https://USERNAME:PASSWORD@HOST
Activate storage helper: git config credential.helper 'store --file=$GITEA_PATH/.gitea_credentials'

An alternative would be to write a custom helper which is connected to the database.

@jonasfranz commented on GitHub (May 24, 2018): I propose the following flow: 1. Create a `.gitea-credentials` file with read-write permissions in the gitea directory. 2. Save the credentials in the following format: `https://USERNAME:PASSWORD@HOST` 3. Activate `storage` helper: `git config credential.helper 'store --file=$GITEA_PATH/.gitea_credentials'` An alternative would be to write a custom helper which is connected to the database.

GiteaMirror commented

2025-11-02 04:13:14 -06:00

@6543 commented on GitHub (Sep 17, 2020):

not the case anymore

@6543 commented on GitHub (Sep 17, 2020): not the case anymore

GiteaMirror referenced this issue

2025-11-02 12:01:15 -06:00

[PR #1786] [MERGED] Fix renaming bug #16054

Sign in to join this conversation.