fluidattacks_core_git/clone/
https.rs

1use anyhow::{Context, Result};
2use base64::Engine;
3use http::uri::{PathAndQuery, Uri};
4use std::fmt;
5use std::path::Path;
6use tokio::process::Command;
7use url::Url;
8
9use super::{build_clone_args, reason, CloneOpts};
10use crate::errors::{GitCallError, HttpsAccessError};
11use crate::types::CredentialKind;
12
13const USER_VAR: &str = "FLUIDATTACKS_GIT_USER";
14const PASSWORD_VAR: &str = "FLUIDATTACKS_GIT_PASSWORD";
15
16// Answers only `get`, so git has nowhere to store or erase the credential.
17fn env_helper() -> String {
18    format!(
19        "!f() {{ if [ \"$1\" = get ]; then \
20         printf 'username=%s\\npassword=%s\\n' \"${USER_VAR}\" \"${PASSWORD_VAR}\"; fi; }}; f"
21    )
22}
23
24// Read as git and curl read it (RFC 3986), host and path left as written: git
25// normalizes the url and the helper key alike when it matches one to the other.
26struct BareUrl {
27    url: String,
28    origin: String,
29}
30
31/// How git reaches a repo over https, with the credential kept off its command
32/// line and out of the url, so that git has none of it to print back.
33///
34/// `git` hands the credential to the repo's own host and to no other, and
35/// never lets git prompt. `secret` is what is still worth taking out of an
36/// error, because a server may echo what it was sent.
37pub struct HttpsAccess {
38    url: String,
39    secret: Option<String>,
40    config: Vec<(String, String)>,
41    env: Vec<(String, String)>,
42}
43
44// By hand, so that printing it, in a log or a failed unwrap, leaves the login out.
45impl fmt::Debug for HttpsAccess {
46    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
47        f.debug_struct("HttpsAccess")
48            .field("url", &self.url)
49            .finish_non_exhaustive()
50    }
51}
52
53impl HttpsAccess {
54    pub fn new(url: &str, credential: Option<&CredentialKind>) -> Result<Self, HttpsAccessError> {
55        match credential {
56            None => Ok(Self::public(url)),
57            Some(CredentialKind::Https { user, password }) => Self::basic(url, user, password),
58            Some(CredentialKind::Token {
59                token,
60                is_pat,
61                oauth_type,
62            }) => {
63                let (user, password) = token_login(token, oauth_type, *is_pat);
64                Ok(Self {
65                    secret: Some(token.clone()),
66                    ..Self::basic(url, user, password)?
67                })
68            }
69            Some(CredentialKind::Ssh { .. } | CredentialKind::AwsRole { .. }) => {
70                Err(HttpsAccessError::NotHttpsCredential)
71            }
72        }
73    }
74
75    fn public(url: &str) -> Self {
76        Self {
77            url: url.to_owned(),
78            secret: None,
79            config: Vec::new(),
80            env: Vec::new(),
81        }
82    }
83
84    fn basic(raw_url: &str, user: &str, password: &str) -> Result<Self, HttpsAccessError> {
85        if [user, password]
86            .iter()
87            .any(|value| value.contains(['\n', '\r', '\0']))
88        {
89            return Err(HttpsAccessError::CredentialLineBreak);
90        }
91        let url = bare_url(raw_url)?;
92        Ok(Self {
93            secret: Some(password.to_owned()),
94            config: vec![(format!("credential.{}.helper", url.origin), env_helper())],
95            env: vec![
96                (USER_VAR.to_owned(), user.to_owned()),
97                (PASSWORD_VAR.to_owned(), password.to_owned()),
98            ],
99            url: url.url,
100        })
101    }
102
103    #[must_use]
104    pub fn url(&self) -> &str {
105        &self.url
106    }
107
108    /// A git command for this repo, still waiting for its subcommand.
109    #[must_use]
110    pub fn git(&self) -> Command {
111        let mut command = Command::new("git");
112        // The empty helper drops whatever helpers the machine has configured,
113        // so the credential is neither looked up in nor saved to them. Going
114        // on the command line, it comes after any config git inherits.
115        command.args(["-c", "credential.helper="]);
116        for (key, value) in &self.config {
117            command.arg("-c").arg(format!("{key}={value}"));
118        }
119        command
120            .env("GIT_TERMINAL_PROMPT", "0")
121            // Unset, git keeps credentials out of its own traces.
122            .env_remove("GIT_TRACE_REDACT")
123            // Its data dump prints what a server sends back, the Basic header included.
124            .env_remove("GIT_TRACE_CURL")
125            .envs(self.env.iter().cloned());
126        command
127    }
128
129    #[must_use]
130    pub fn secret(&self) -> Option<&str> {
131        self.secret.as_deref()
132    }
133}
134
135fn bare_url(raw_url: &str) -> Result<BareUrl, HttpsAccessError> {
136    let uri: Uri = raw_url.parse().map_err(|_| HttpsAccessError::Unparsable)?;
137    let scheme = uri
138        .scheme_str()
139        .filter(|scheme| matches!(*scheme, "http" | "https"))
140        .ok_or(HttpsAccessError::NotHttp)?;
141    let authority = uri.authority().ok_or(HttpsAccessError::Unparsable)?;
142    let port = authority
143        .port()
144        .map_or_else(String::new, |port| format!(":{port}"));
145    let host = format!("{}{port}", authority.host());
146    // An empty host, or a port the parser could not read and left out.
147    if authority.host().is_empty() || !authority.as_str().ends_with(&host) {
148        return Err(HttpsAccessError::Unparsable);
149    }
150    let origin = format!("{scheme}://{host}");
151    let path = uri.path_and_query().map_or("", PathAndQuery::as_str);
152    Ok(BareUrl {
153        url: format!("{origin}{path}"),
154        origin,
155    })
156}
157
158// A token with no provider is the user itself, with no password. A PAT takes
159// any user but an empty one, since git sends no credential without a user.
160const fn token_login<'a>(token: &'a str, provider: &str, is_pat: bool) -> (&'a str, &'a str) {
161    if is_pat {
162        ("pat", token)
163    } else if provider.eq_ignore_ascii_case("BITBUCKET") {
164        ("x-token-auth", token)
165    } else if provider.is_empty() {
166        (token, "")
167    } else {
168        ("oauth2", token)
169    }
170}
171
172pub async fn clone_https(opts: &CloneOpts, dest: &Path) -> Result<()> {
173    let kind = &opts
174        .credentials
175        .as_ref()
176        .context("missing credentials")?
177        .kind;
178    if !matches!(kind, CredentialKind::Https { .. }) {
179        anyhow::bail!("expected HTTPS credentials");
180    }
181    Ok(run_git_clone(opts, dest, &HttpsAccess::new(&opts.repo_url, Some(kind))?).await?)
182}
183
184pub async fn clone_https_token(opts: &CloneOpts, dest: &Path) -> Result<()> {
185    let kind = &opts
186        .credentials
187        .as_ref()
188        .context("missing credentials")?
189        .kind;
190    if !matches!(kind, CredentialKind::Token { .. }) {
191        anyhow::bail!("expected Token credentials");
192    }
193    Ok(run_git_clone(opts, dest, &HttpsAccess::new(&opts.repo_url, Some(kind))?).await?)
194}
195
196pub async fn clone_https_public(opts: &CloneOpts, dest: &Path) -> Result<()> {
197    Ok(run_git_clone(opts, dest, &HttpsAccess::public(&opts.repo_url)).await?)
198}
199
200/// Build git config args for HTTPS operations (equivalent to Python's `get_https_git_config_args`).
201#[must_use]
202pub fn build_https_config_args(
203    follow_redirects: bool,
204    is_pat: bool,
205    token: Option<&str>,
206    disable_credential_prompt: bool,
207) -> Vec<String> {
208    let mut args = vec![
209        "-c".to_owned(),
210        "http.sslVerify=false".to_owned(),
211        "-c".to_owned(),
212        format!("http.followRedirects={follow_redirects}"),
213    ];
214    if is_pat {
215        if let Some(t) = token {
216            let encoded = base64::engine::general_purpose::STANDARD.encode(format!(":{t}"));
217            args.extend([
218                "-c".to_owned(),
219                format!("http.extraHeader=Authorization: Basic {encoded}"),
220            ]);
221        }
222    }
223    if disable_credential_prompt {
224        args.extend(["-c".to_owned(), "credential.helper=".to_owned()]);
225    }
226    args
227}
228
229/// Format URL with credentials embedded (equivalent to Python's `format_url`).
230#[allow(clippy::too_many_arguments)]
231pub fn format_https_url(
232    repo_url: &str,
233    user: Option<&str>,
234    password: Option<&str>,
235    token: Option<&str>,
236    provider: Option<&str>,
237    is_pat: bool,
238) -> Result<String> {
239    let mut parsed = Url::parse(repo_url).context("parsing URL")?;
240    // Re-quote the path
241    let path = parsed.path().to_owned();
242    parsed.set_path(&path);
243
244    if is_pat {
245        return Ok(parsed.to_string());
246    }
247
248    if let Some(t) = token {
249        let user_part = match provider {
250            Some(p) if p.eq_ignore_ascii_case("BITBUCKET") => "x-token-auth",
251            Some("") | None => "",
252            Some(_) => "oauth2",
253        };
254        if user_part.is_empty() {
255            // No provider: use token as username, no password
256            parsed
257                .set_username(t)
258                .map_err(|()| anyhow::anyhow!("set username"))?;
259            parsed
260                .set_password(None)
261                .map_err(|()| anyhow::anyhow!("set password"))?;
262        } else {
263            // Use username/password separately to avoid percent-encoding the colon
264            parsed
265                .set_username(user_part)
266                .map_err(|()| anyhow::anyhow!("set username"))?;
267            parsed
268                .set_password(Some(t))
269                .map_err(|()| anyhow::anyhow!("set password"))?;
270        }
271        return Ok(parsed.to_string());
272    }
273
274    if let (Some(u), Some(p)) = (user, password) {
275        parsed
276            .set_username(u)
277            .map_err(|()| anyhow::anyhow!("set username"))?;
278        parsed
279            .set_password(Some(p))
280            .map_err(|()| anyhow::anyhow!("set password"))?;
281        return Ok(parsed.to_string());
282    }
283
284    Ok(parsed.to_string())
285}
286
287pub(super) async fn run_git_clone(
288    opts: &CloneOpts,
289    dest: &Path,
290    access: &HttpsAccess,
291) -> Result<(), GitCallError> {
292    let extra_config = vec!["-c".to_owned(), "http.sslVerify=false".to_owned()];
293    let args = build_clone_args(opts, access.url(), dest, &extra_config);
294    let mut command = access.git();
295    command.args(&args);
296    reason::run(&mut command, access.secret().as_slice()).await
297}
298
299#[cfg(test)]
300mod tests {
301    use super::{format_https_url, token_login, HttpsAccess};
302    use crate::errors::HttpsAccessError;
303    use crate::types::CredentialKind;
304    use std::ffi::OsString;
305
306    fn args(access: &HttpsAccess) -> Vec<String> {
307        access
308            .git()
309            .as_std()
310            .get_args()
311            .map(|arg| arg.to_string_lossy().into_owned())
312            .collect()
313    }
314
315    fn token(token: &str, provider: &str) -> CredentialKind {
316        CredentialKind::Token {
317            token: token.to_owned(),
318            is_pat: false,
319            oauth_type: provider.to_owned(),
320        }
321    }
322
323    #[test]
324    fn a_token_with_no_provider_logs_in_as_the_user_with_no_password() {
325        assert_eq!(token_login("tok", "", false), ("tok", ""));
326    }
327
328    #[test]
329    fn the_provider_names_the_user_even_off_its_own_domain() {
330        assert_eq!(
331            token_login("tok", "BITBUCKET", false),
332            ("x-token-auth", "tok")
333        );
334        assert_eq!(token_login("tok", "GITLAB", false), ("oauth2", "tok"));
335    }
336
337    #[test]
338    fn the_provider_is_matched_ignoring_the_case() {
339        let url = "https://host/a/b.git";
340
341        assert_eq!(
342            format_https_url(url, None, None, Some("tok"), Some("Bitbucket"), false).unwrap(),
343            format_https_url(url, None, None, Some("tok"), Some("BITBUCKET"), false).unwrap()
344        );
345        assert_eq!(
346            token_login("tok", "Bitbucket", false),
347            token_login("tok", "BITBUCKET", false)
348        );
349    }
350
351    fn basic(user: &str, password: &str) -> CredentialKind {
352        CredentialKind::Https {
353            user: user.to_owned(),
354            password: password.to_owned(),
355        }
356    }
357
358    #[test]
359    fn the_url_drops_whatever_credential_it_carried() {
360        let access = HttpsAccess::new(
361            "https://olduser:oldpass@host/a/b.git",
362            Some(&token("tok", "")),
363        )
364        .unwrap();
365        assert_eq!(access.url(), "https://host/a/b.git");
366    }
367
368    #[test]
369    fn a_pat_logs_in_as_a_placeholder_user_whatever_the_provider() {
370        assert_eq!(token_login("tok", "", true), ("pat", "tok"));
371        assert_eq!(token_login("tok", "BITBUCKET", true), ("pat", "tok"));
372    }
373
374    #[test]
375    fn the_host_is_left_as_written_for_git_to_read() {
376        for (url, expected) in [
377            ("https://Host:443/a.git", "https://Host:443/a.git"),
378            ("https://[::1]:8443/a.git", "https://[::1]:8443/a.git"),
379            ("https://u:p@w@host/a.git", "https://host/a.git"),
380        ] {
381            let access = HttpsAccess::new(url, Some(&token("tok", ""))).unwrap();
382            let origin = expected.trim_end_matches("/a.git");
383            assert_eq!(access.url(), expected, "{url}");
384            let helper = format!("credential.{origin}.helper=");
385            let host = args(&access).get(3).cloned().unwrap_or_default();
386            assert!(host.starts_with(&helper), "{url}");
387        }
388    }
389
390    #[test]
391    fn each_failure_says_what_the_python_said_and_never_the_url() {
392        for (url, expected) in [
393            ("ftp://u:hunter2@host/a.git", HttpsAccessError::NotHttp),
394            ("host/a.git", HttpsAccessError::Unparsable),
395            ("https:u:hunter2@host/a.git", HttpsAccessError::Unparsable),
396            ("https:///host/a.git", HttpsAccessError::Unparsable),
397            ("https://u:hunter2@/a.git", HttpsAccessError::Unparsable),
398            ("https://u:hunter2@:443/a.git", HttpsAccessError::Unparsable),
399            (
400                "https://u:hunter2@host:99999/a.git",
401                HttpsAccessError::Unparsable,
402            ),
403            (
404                "https://u:hunter2@faß.de/a.git",
405                HttpsAccessError::Unparsable,
406            ),
407            (
408                "https://tok\\hunter2@host/a.git",
409                HttpsAccessError::Unparsable,
410            ),
411        ] {
412            let error = HttpsAccess::new(url, Some(&token("tok", ""))).unwrap_err();
413            assert_eq!(error, expected, "{url}");
414            assert!(!error.to_string().contains("hunter2"), "{url}");
415        }
416        assert_eq!(
417            HttpsAccessError::NotHttp.to_string(),
418            "expected an http or https url"
419        );
420        assert_eq!(
421            HttpsAccessError::Unparsable.to_string(),
422            "Invalid url: its host or port could not be parsed"
423        );
424    }
425
426    #[test]
427    fn no_credential_leaves_the_url_unchecked() {
428        let access = HttpsAccess::new("ftp://host:99999/a.git", None).unwrap();
429        assert_eq!(access.url(), "ftp://host:99999/a.git");
430        assert_eq!(args(&access), ["-c", "credential.helper="]);
431    }
432
433    #[test]
434    fn the_debug_shows_neither_the_login_nor_the_environment() {
435        let access =
436            HttpsAccess::new("https://host/a.git", Some(&basic("someone", "s3cr3t"))).unwrap();
437        let shown = format!("{access:?}");
438        assert!(shown.contains("https://host/a.git"), "{shown}");
439        assert!(!shown.contains("s3cr3t"), "{shown}");
440        assert!(!shown.contains("someone"), "{shown}");
441    }
442
443    #[test]
444    fn the_machine_helpers_are_dropped_before_the_host_helper() {
445        let access = HttpsAccess::new("https://host/a.git", Some(&token("tok", ""))).unwrap();
446        let args = args(&access);
447        let [flag, machine, host_flag, host] = args.as_slice() else {
448            panic!("{args:?}");
449        };
450        assert_eq!(
451            [flag, machine, host_flag],
452            ["-c", "credential.helper=", "-c"]
453        );
454        assert!(
455            host.starts_with("credential.https://host.helper=!f()"),
456            "{host}"
457        );
458    }
459
460    #[test]
461    fn the_login_goes_through_the_environment() {
462        let access = HttpsAccess::new("https://host/a.git", Some(&basic("u", "p"))).unwrap();
463        let envs: Vec<_> = access
464            .git()
465            .as_std()
466            .get_envs()
467            .map(|(name, value)| (name.to_owned(), value.map(ToOwned::to_owned)))
468            .collect();
469        let set = |value: &str| Some(OsString::from(value));
470        assert_eq!(
471            envs,
472            [
473                ("FLUIDATTACKS_GIT_PASSWORD".into(), set("p")),
474                ("FLUIDATTACKS_GIT_USER".into(), set("u")),
475                ("GIT_TERMINAL_PROMPT".into(), set("0")),
476                ("GIT_TRACE_CURL".into(), None),
477                ("GIT_TRACE_REDACT".into(), None),
478            ]
479        );
480    }
481
482    #[test]
483    fn a_credential_with_a_line_break_or_a_nul_is_refused() {
484        for credential in [
485            token("tok\nhost=x", ""),
486            token("tok\0x", "GITLAB"),
487            basic("u\rx", "p"),
488            basic("u", "p\nx"),
489        ] {
490            let error = HttpsAccess::new("https://host/a/b.git", Some(&credential)).unwrap_err();
491            assert_eq!(error, HttpsAccessError::CredentialLineBreak);
492            assert_eq!(
493                error.to_string(),
494                "Invalid credentials: a line break or a nul byte"
495            );
496        }
497    }
498
499    #[test]
500    fn an_empty_provider_formats_the_url_like_no_provider_at_all() {
501        let url = "https://gitlab.com/a/b.git";
502        let no_provider = format_https_url(url, None, None, Some("tok"), None, false).unwrap();
503        assert_eq!(no_provider, "https://tok@gitlab.com/a/b.git");
504        assert_eq!(
505            format_https_url(url, None, None, Some("tok"), Some(""), false).unwrap(),
506            no_provider
507        );
508    }
509}
fluidattacks_core_git/clone/https.rs

fluidattacks_core_git/clone/
https.rs
