Re: [PATCH backup v2 1/3] fix #7054: client: remove trailing newlines from credentials

[Maximiliano Sandoval <m.sandoval@proxmox.com>]

Christian Ebner <c.ebner@proxmox.com> writes:

> On 2/20/26 1:38 PM, Maximiliano Sandoval wrote:
>> For repositories and fingerprints we simply strip trailing whitespaces.
>
> This should explicitly state that this is done for improved usability.
>
>> For passwords, we refer to the password regex at proxmox-schema:
>> `^[[:^cntrl:]]*$`, we can only strip trailing control characters without
>> potentially breaking existing passwords.
>
> This is however not what the patch does, it only strips trailing newlines from
> the password blob, leaving other control characters in place to be matched by
> the schema's regex.

This was recommended off-list. I will update the commit message and send
v3.

>> The encryption password is just a blob of bytes handled locally by the
>> client, we cannot remove trailing whitespace here without potential
>> breakage. Creation of such passwords (via
>> proxmox_sys::tty::read_and_verify_password) only verifies valid utf-8
>> and len >= 5.
>> Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
>> ---
>>   pbs-client/src/tools/mod.rs | 12 +++++++++++-
>>   1 file changed, 11 insertions(+), 1 deletion(-)
>> diff --git a/pbs-client/src/tools/mod.rs b/pbs-client/src/tools/mod.rs
>> index 7a496d14c..f28d9f32f 100644
>> --- a/pbs-client/src/tools/mod.rs
>> +++ b/pbs-client/src/tools/mod.rs
>> @@ -168,7 +168,17 @@ fn get_secret_impl(env_variable: &str, credential_name: &str) -> Result<Option<S
>>       if let Some(password) = get_secret_from_env(env_variable)? {
>>           Ok(Some(password))
>>       } else if let Some(password) = get_credential(credential_name)? {
>> -        String::from_utf8(password)
>> +        str::from_utf8(&password)
>> +            .map(|s| {
>> +                if matches!(credential_name, CRED_PBS_REPOSITORY | CRED_PBS_FINGERPRINT) {
>> +                    s.trim_end()
>> +                } else if credential_name == CRED_PBS_PASSWORD {
>> +                    s.trim_end_matches('\n')
>> +                } else {
>> +                    s
>> +                }
>> +            })
>> +            .map(ToOwned::to_owned)
>>               .map(Option::Some)
>>               .map_err(|_err| format_err!("credential {credential_name} is not utf8 encoded"))
>>       } else {

-- 
Maximiliano