Migration: Spawned git process includes username and password in cleartext

[sebastian-sauer]

• Operating system: Debian 9.4
• Gitea version (or commit ref): 1.4.1
• Git version: 2.11.0
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist: << not needed >>

Description

When migrating a password protected repository via the migrate functionality git will be spawned on the command line with username & password in the remote url, resulting in processes visible with username & password in clear text.

For example (just one spawned process by git):

git fetch-pack --stateless-rpc --stdin --lock-pack --thin --check-self-contained-and-connected --cloning --no-progress https://user:password@remote-repo/git.git

Possible workaround: Use a temporary file to store the password & username and use core.askpass when spawning git processes (as jenkins and other CI tools do for example)

[jonasfranz]

I propose the following flow:

1. Create a .gitea-credentials file with read-write permissions in the gitea directory.
2. Save the credentials in the following format: https://USERNAME:PASSWORD@HOST
3. Activate storage helper: git config credential.helper 'store --file=$GITEA_PATH/.gitea_credentials'

An alternative would be to write a custom helper which is connected to the database.

[6543]

not the case anymore