bug#49289: 28.0.50; auth-source-search may return doubly obfuscated :secret value

bug#49289: 28.0.50; auth-source-search may return doubly obfuscated :secret value

[Kazuhiro Ito]

When I have ~/.authinfo entry of 'mail.example.com' for user 'foo' but
not user 'bar',

~/.authinfo
machine mail.example.com login foo password abcdef

for user other than 'foo', auth-source-search returns a function which
returns a function which returns a string.

(progn
  (require 'auth-source)
  (list
   (funcall
    (plist-get
     (car (auth-source-search
	   :host "mail.example.com" :user "foo"
	   :require '(:secret) :create t))
     :secret))
   (funcall
    (funcall
     ;; *** funcall called twice. ***
     (plist-get
      (car (auth-source-search
	    :host "mail.example.com" :user "bar"
	    :require '(:secret) :create t))
      :secret)))))

-> ("abcdef" "abcdef")

I don't know whether auth-source supports multiple accounts on the
same host and whether it is a feature that auth-source-search tend to
return other user's password.  But I think doubly obfuscated :secret
value is obviously a bug.

-- 
Kazuhiro Ito

bug#49289: 28.0.50; auth-source-search may return doubly obfuscated :secret value

[Lars Ingebrigtsen]

Kazuhiro Ito <kzhr@d1.dion.ne.jp> writes:

> I don't know whether auth-source supports multiple accounts on the
> same host and whether it is a feature that auth-source-search tend to
> return other user's password.  But I think doubly obfuscated :secret
> value is obviously a bug.

I think both things are bugs, and the second happens because of the
first bug.  I've now pushed a fix for this to Emacs 28.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

bug#49289: 28.0.50; auth-source-search may return doubly obfuscated :secret value

[Michael Albinus via Bug reports for GNU Emacs, the Swiss army knife of text editors]

Lars Ingebrigtsen <larsi@gnus.org> writes:

> Kazuhiro Ito <kzhr@d1.dion.ne.jp> writes:
>
>> I don't know whether auth-source supports multiple accounts on the
>> same host and whether it is a feature that auth-source-search tend to
>> return other user's password.  But I think doubly obfuscated :secret
>> value is obviously a bug.
>
> I think both things are bugs, and the second happens because of the
> first bug.  I've now pushed a fix for this to Emacs 28.

FTR, I've pushed a similar fix to the secrets and plstore backends. Will
be visible with Emacs 30.

Best regards, Michael.