Re: [PATCH backup v3 1/3] fix #7054: client: remove trailing newlines from credentials

[Maximiliano Sandoval <m.sandoval@proxmox.com>]

Christian Ebner <c.ebner@proxmox.com> writes:

> two comments inline.
>
> On 2/23/26 10:37 AM, Maximiliano Sandoval wrote:
>> Many tools, including systemd-ask-password will add a trailing new line, in
>> order to improve usability we strip trailing newlines.
>> For repositories and fingerprints we simply strip trailing whitespaces.
>> For passwords, we refer to the password regex at proxmox-schema:
>> `^[[:^cntrl:]]*$`, we can only strip trailing control characters without
>> potentially breaking existing passwords. For the sake of avoiding to
>> strip more than necessary we only strip trailing newlines.
>> The encryption password is just a blob of bytes handled locally by the
>> client, we cannot remove trailing whitespace here without potential
>> breakage. Creation of such passwords (via
>> proxmox_sys::tty::read_and_verify_password) only verifies valid utf-8
>> and len >= 5.
>> Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
>> ---
>>   pbs-client/src/tools/mod.rs | 12 +++++++++++-
>>   1 file changed, 11 insertions(+), 1 deletion(-)
>> diff --git a/pbs-client/src/tools/mod.rs b/pbs-client/src/tools/mod.rs
>> index 7a496d14c..f28d9f32f 100644
>> --- a/pbs-client/src/tools/mod.rs
>> +++ b/pbs-client/src/tools/mod.rs
>> @@ -168,7 +168,17 @@ fn get_secret_impl(env_variable: &str, credential_name: &str) -> Result<Option<S
>>       if let Some(password) = get_secret_from_env(env_variable)? {
>>           Ok(Some(password))
>>       } else if let Some(password) = get_credential(credential_name)? {
>> -        String::from_utf8(password)
>> +        str::from_utf8(&password)
>> +            .map(|s| {
>> +                if matches!(credential_name, CRED_PBS_REPOSITORY | CRED_PBS_FINGERPRINT) {
>> +                    s.trim_end()
>> +                } else if credential_name == CRED_PBS_PASSWORD {
>> +                    s.trim_end_matches('\n')
>> +                } else {
>> +                    s
>> +                }
>
> since this depends on the provided credential name anyways, why not do it in the
> respective helpers instead, e.g. get_password() or get_default_repository()? By
> that it is possible to avoid the conditional trimming here.

Done in v4.

>> +            })
>> +            .map(ToOwned::to_owned)
>>               .map(Option::Some)
>>               .map_err(|_err| format_err!("credential {credential_name} is not utf8 encoded"))
>>       } else {
>
> What about CRED_PBS_ENCRYPTION_PASSWORD? That should be handled as well.

As explained in the commit message, the encryption password could end in
'\n'.

-- 
Maximiliano