Re: [PATCH backup v2 1/3] fix #7054: client: remove trailing newlines from credentials

[Christian Ebner <c.ebner@proxmox.com>]

On 2/20/26 1:38 PM, Maximiliano Sandoval wrote:
> For repositories and fingerprints we simply strip trailing whitespaces.

This should explicitly state that this is done for improved usability.

> For passwords, we refer to the password regex at proxmox-schema:
> `^[[:^cntrl:]]*$`, we can only strip trailing control characters without
> potentially breaking existing passwords.

This is however not what the patch does, it only strips trailing 
newlines from the password blob, leaving other control characters in 
place to be matched by the schema's regex.

> The encryption password is just a blob of bytes handled locally by the
> client, we cannot remove trailing whitespace here without potential
> breakage. Creation of such passwords (via
> proxmox_sys::tty::read_and_verify_password) only verifies valid utf-8
> and len >= 5.
> 
> Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
> ---
>   pbs-client/src/tools/mod.rs | 12 +++++++++++-
>   1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/pbs-client/src/tools/mod.rs b/pbs-client/src/tools/mod.rs
> index 7a496d14c..f28d9f32f 100644
> --- a/pbs-client/src/tools/mod.rs
> +++ b/pbs-client/src/tools/mod.rs
> @@ -168,7 +168,17 @@ fn get_secret_impl(env_variable: &str, credential_name: &str) -> Result<Option<S
>       if let Some(password) = get_secret_from_env(env_variable)? {
>           Ok(Some(password))
>       } else if let Some(password) = get_credential(credential_name)? {
> -        String::from_utf8(password)
> +        str::from_utf8(&password)
> +            .map(|s| {
> +                if matches!(credential_name, CRED_PBS_REPOSITORY | CRED_PBS_FINGERPRINT) {
> +                    s.trim_end()
> +                } else if credential_name == CRED_PBS_PASSWORD {
> +                    s.trim_end_matches('\n')
> +                } else {
> +                    s
> +                }
> +            })
> +            .map(ToOwned::to_owned)
>               .map(Option::Some)
>               .map_err(|_err| format_err!("credential {credential_name} is not utf8 encoded"))
>       } else {