janware/jw-pkg
Watch
1
Code Pull requests 1 Activity Actions

lib.ec.ssh.Exec: Fix askpass script #105

Merged
Jan Lindemann merged 1 commit from jan/fix/20260914-lib-ec-ssh-exec-fix-askpass-script into master 2026-09-14 20:47:10 +02:00 AGit
Conversation 0 Commits 1 Files changed 5 +62 -3
Jan Lindemann commented 2026-09-14 20:32:15 +02:00
Owner
Copy link

lib.ec.ssh.Exec: Fix askpass script

__init_askpass() embeds the password verbatim in a generated bash script, with a newline included inside the double quotes of the echo -n. The askpass program therefore always appends a newline to the password, and any password containing quotes or shell metacharacters either breaks the script or injects commands into it.

Embed the password as base64 and decode it with printf piped into base64 -d, so the script is safe for any password and prints the password exactly, byte for byte.

Make del() idempotent: it deletes the environment variables and the script file, so a second call, e.g. an explicit one followed by garbage collection, raises KeyError and FileNotFoundError.

Add a unit test that executes the generated script and compares its output with the password byte for byte.

#### lib.ec.ssh.Exec: Fix askpass script __init_askpass() embeds the password verbatim in a generated bash script, with a newline included inside the double quotes of the echo -n. The askpass program therefore always appends a newline to the password, and any password containing quotes or shell metacharacters either breaks the script or injects commands into it. Embed the password as base64 and decode it with printf piped into base64 -d, so the script is safe for any password and prints the password exactly, byte for byte. Make __del__() idempotent: it deletes the environment variables and the script file, so a second call, e.g. an explicit one followed by garbage collection, raises KeyError and FileNotFoundError. Add a unit test that executes the generated script and compares its output with the password byte for byte.
lib.ec.ssh.Exec: Fix askpass script
All checks were successful
CI / Packaging - Kali Linux (pull_request) Successful in 4m10s
Details
CI / Packaging - OpenSUSE Tumbleweed (pull_request) Successful in 4m21s
Details
CI / Packaging test (pull_request) Successful in 0s
Details
CI / Packaging - Kali Linux (push) Successful in 4m3s
Details
CI / Packaging - OpenSUSE Tumbleweed (push) Successful in 4m32s
Details
CI / Packaging test (push) Successful in 0s
Details
dc101a5a7f
 
__init_askpass() embeds the password verbatim in a generated bash script,
with a newline included inside the double quotes of the echo -n. The
askpass program therefore always appends a newline to the password, and
any password containing quotes or shell metacharacters either breaks the
script or injects commands into it.

Embed the password as base64 and decode it with printf piped into base64
-d, so the script is safe for any password and prints the password exactly,
byte for byte.

Make __del__() idempotent: it deletes the environment variables and the
script file, so a second call, e.g. an explicit one followed by garbage
collection, raises KeyError and FileNotFoundError.

Add a unit test that executes the generated script and compares its output
with the password byte for byte.

Signed-off-by: Jan Lindemann <jan@janware.com>
Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v0.85.1
Jan Lindemann scheduled this pull request to auto merge when all checks succeed 2026-09-14 20:32:16 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
janware/jw-pkg!105
No description provided.