Re: [BUG] You can't have single quote in your username

From: Jeff King <peff@peff.net>
To: "SZEDER Gábor" <szeder.dev@gmail.com>
Cc: "Pratyush Yadav" <me@yadavpratyush.com>,
	"Emily Shaffer" <emilyshaffer@google.com>,
	"Bryan Turner" <bturner@atlassian.com>,
	"Giuseppe Crinò" <giuscri@gmail.com>,
	"Git Users" <git@vger.kernel.org>
Subject: Re: [BUG] You can't have single quote in your username
Date: Mon, 26 Aug 2019 15:14:55 -0400	[thread overview]
Message-ID: <20190826191455.GA25695@sigill.intra.peff.net> (raw)
In-Reply-To: <20190823082900.GG20404@szeder.dev>

On Fri, Aug 23, 2019 at 10:29:00AM +0200, SZEDER Gábor wrote:

> On Fri, Aug 23, 2019 at 12:13:12AM +0530, Pratyush Yadav wrote:
> > > Does it make more sense to replace this strbuf_addstr_without_crud()
> > > setup with something more intelligent (i.e. checking for matching crud
> > > on either end, like ^[$crudchars].*\1$? We already check for matched <>.
> > 
> > Sounds like something easy enough to implement. There are two types of 
> > characters that crud() removes: there are the ones which _should_ appear 
> > on both the start and end (', ", <, >), and the ones which don't 
> > necessarily have to (., ,, :, ;, \).
> > 
> > So we'd need to handle two cases. For the former type, remove a 
> > character both at the start and at the end. For the latter, remove only 
> > where they appear.
> 
> If we go down this route, then someone might want to write ő as o" or
> ű as u", which still supposed to be used in pairs, but what if someone
> wants to write ä as a:, ö as o:, ü as u:, ç as "c,", ş as "s,", etc.
> 
> What I wonder is whether we really have to remove crud from the user
> name if it comes from the configuration.

Probably not. I think most of this crud-handling is really about pulling
names out of email. Digging around in the archive, one of the few
entries that actually talks about this crud-removal being helpful is:

  https://public-inbox.org/git/alpine.LFD.2.00.0812010836280.3256@nehalem.linux-foundation.org/

So it might make sense to push these rules into "git mailinfo" instead
of applying them everywhere. But we'd still need something at least for
GECOS, where "Your Name,,,," is common.

Unfortunately since these rules have been in place for ages, we don't
really know how often they're helping. Loosening it just for user.name,
etc is probably the most conservative choice.

We'd still want to keep the low-level removal of "<>\n", since those are
syntactically significant to Git (i.e., if they sneak in you end up with
a broken commit object). There's some discussion in this thread (which
is also about trailing single-quotes!):

  https://public-inbox.org/git/20120629124122.GG1258@camk.edu.pl/

Another real-world case that would be helped is: "Your Name, Jr.":

  https://public-inbox.org/git/CAMP44s2OoxUVFE57e8C2Km7rcGn88KkLXxdaA3s5RE6nZ7TU=A@mail.gmail.com/

-Peff