Re: [Duplicity-talk] unbalanced parenthesis in password breaks duplicity

[edgar . soldin]

well it isn't because the whole function replaces everything in the url 
that is the same string as the password e.g. 
ftp://user:address@hidden/some/path becomes 
ftp://user:<passwd>@<passwd>.com/some/path
That's why I took the time to build the regular expression ... No reason 
to keep a dirty solution if we have to change it anyways...

.. ede

On 25.10.2009 17:11, Daniel Hahler wrote:
> On Saturday 24 October 2009 21:00:00 edgar soldin wrote:
>
> > In connection to a bug in duply i stumbled over this one in duplicity
> > ... I used a password containing an unclosed parenthesis eg. 'test)foo'
> > ... I also spend some time to figure out a fix. It could be the
> > replacement of line 359 in backend.py (version 0.6.05) .. here a
> > modified version of the function. The commented line is the original.
> > The replacement above splits the url in protocol, credentials, rest and
> > creates 'prot://[user:address@hidden' string which should suffice for
> > obfuscation . The documentation has to be adapted of course.
> >
> > ...ede
>
> The proper fix appears to be using re.escape to escape the password:
> return re.sub(re.escape(self.parsed_url.password), '<passwd>', commandline)
>
>
> Cheers,
> Daniel
>
> > --FIX-->
> >
> >       def munge_password(self, commandline):
> > [SNIP]
> >           if self.parsed_url.password:
> >               return re.sub(r'^([^:/]+)://(([^:/@]*):?([^:/@]*))@?(.*)$',
> > r'\1://\3:address@hidden', commandline)
> >               #return re.sub(self.parsed_url.password, '<passwd>',
> > commandline)
> >           else:
> >               return commandline
> >
> >
> > ---ERROR-->
> >
> > Traceback (most recent call last):
> >     File
> > "/srv/www/vhosts/jamoke.net/_apps/duplicity-0.6.05/bin/duplicity", line
> > 1242, in<module>
> >       with_tempdir(main)
> >     File
> > "/srv/www/vhosts/jamoke.net/_apps/duplicity-0.6.05/bin/duplicity", line
> > 1235, in with_tempdir
> >       fn()
> >     File
> > "/srv/www/vhosts/jamoke.net/_apps/duplicity-0.6.05/bin/duplicity", line
> > 1136, in main
> >       sync_archive()
> >     File
> > "/srv/www/vhosts/jamoke.net/_apps/duplicity-0.6.05/bin/duplicity", line
> > 915, in sync_archive
> >       remlist = globals.backend.list()
> >     File
> > "/srv/www/vhosts/jamoke.net/_apps/duplicity-0.6.05/duplicity/backends/ftpba
> > ckend.py", line 109, in list
> >       l = self.popen_persist(commandline).split('
> > ')
> >     File
> > "/srv/www/vhosts/jamoke.net/_apps/duplicity-0.6.05/bin/../duplicity/backend
> > .py", line 416, in popen_persist
> >       private = self.munge_password(commandline)
> >     File
> > "/srv/www/vhosts/jamoke.net/_apps/duplicity-0.6.05/bin/../duplicity/backend
> > .py", line 360, in munge_password
> >       return re.sub(self.parsed_url.password, '<passwd>', commandline)
> >     File "/usr/lib/python2.6/re.py", line 150, in sub
> >       return _compile(pattern, 0).sub(repl, string, count)
> >     File "/usr/lib/python2.6/re.py", line 243, in _compile
> >       raise error, v # invalid expression
> > error: unbalanced parenthesis
>
>
>
> _______________________________________________
> Duplicity-talk mailing list
> address@hidden
> http://lists.nongnu.org/mailman/listinfo/duplicity-talk