Re: [PATCH backup v3 1/3] fix #7054: client: remove trailing newlines from credentials

[Christian Ebner <c.ebner@proxmox.com>]

two comments inline.

On 2/23/26 10:37 AM, Maximiliano Sandoval wrote:
> Many tools, including systemd-ask-password will add a trailing new line, in
> order to improve usability we strip trailing newlines.
> 
> For repositories and fingerprints we simply strip trailing whitespaces.
> For passwords, we refer to the password regex at proxmox-schema:
> `^[[:^cntrl:]]*$`, we can only strip trailing control characters without
> potentially breaking existing passwords. For the sake of avoiding to
> strip more than necessary we only strip trailing newlines.
> 
> The encryption password is just a blob of bytes handled locally by the
> client, we cannot remove trailing whitespace here without potential
> breakage. Creation of such passwords (via
> proxmox_sys::tty::read_and_verify_password) only verifies valid utf-8
> and len >= 5.
> 
> Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
> ---
>   pbs-client/src/tools/mod.rs | 12 +++++++++++-
>   1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/pbs-client/src/tools/mod.rs b/pbs-client/src/tools/mod.rs
> index 7a496d14c..f28d9f32f 100644
> --- a/pbs-client/src/tools/mod.rs
> +++ b/pbs-client/src/tools/mod.rs
> @@ -168,7 +168,17 @@ fn get_secret_impl(env_variable: &str, credential_name: &str) -> Result<Option<S
>       if let Some(password) = get_secret_from_env(env_variable)? {
>           Ok(Some(password))
>       } else if let Some(password) = get_credential(credential_name)? {
> -        String::from_utf8(password)
> +        str::from_utf8(&password)
> +            .map(|s| {
> +                if matches!(credential_name, CRED_PBS_REPOSITORY | CRED_PBS_FINGERPRINT) {
> +                    s.trim_end()
> +                } else if credential_name == CRED_PBS_PASSWORD {
> +                    s.trim_end_matches('\n')
> +                } else {
> +                    s
> +                }

since this depends on the provided credential name anyways, why not do 
it in the respective helpers instead, e.g. get_password() or 
get_default_repository()? By that it is possible to avoid the 
conditional trimming here.

> +            })
> +            .map(ToOwned::to_owned)
>               .map(Option::Some)
>               .map_err(|_err| format_err!("credential {credential_name} is not utf8 encoded"))
>       } else {

What about CRED_PBS_ENCRYPTION_PASSWORD? That should be handled as well.