netrc parsing is overly strict #79089

Activity

1. ianwremmel commented on Oct 5, 2018

   

   ianwremmelmannequin

   on Oct 5, 2018

   MannequinAuthor

   More actions

   This started as a bug report for httpie httpie/cli#717 (comment)

   And became a bug report for requests psf/requests#4813

   But turned out to be an issue with Python's netrc parser:

   it appears that auth via netrc is broken if ~/.netrc includes entries that are not exactly login/password tuples. For example, I have the following entries for circle ci and heroku:

      machine api.heroku.com
        login <redacted>
        password <redacted>
        method interactive
      machine circleci.com
        login <redacted>
   

   both of these entries prevent my entry for github.com from working with httpie (but curl works just fine).

   I've used the following script to test python 2.7 and 3.7:

   import netrc
   import os.path
   
   netrc.netrc(os.path.expanduser('~/.netrc')).authenticators('api.github.com')
   

   Python 2:

   Traceback (most recent call last):
     File "test.py", line 4, in <module>
       netrc.netrc(os.path.expanduser('~/.netrc')).authenticators('api.github.com')
     File "/usr/local/Cellar/python@2/2.7.15_1/Frameworks/Python.framework/Versions/2.7/lib/python2.7/netrc.py", line 35, in __init__
       self._parse(file, fp, default_netrc)
     File "/usr/local/Cellar/python@2/2.7.15_1/Frameworks/Python.framework/Versions/2.7/lib/python2.7/netrc.py", line 117, in _parse
       file, lexer.lineno)
   netrc.NetrcParseError: bad follower token 'method' (/Users/ian/.netrc, line 7)
   ```\`
   
   Python 3:
   

   Traceback (most recent call last):
   File "test.py", line 4, in
   netrc.netrc(os.path.expanduser('~/.netrc')).authenticators('api.github.com')
   File "/usr/local/Cellar/python/3.7.0/Frameworks/Python.framework/Versions/3.7/lib/python3.7/netrc.py", line 30, in init
   self._parse(file, fp, default_netrc)
   File "/usr/local/Cellar/python/3.7.0/Frameworks/Python.framework/Versions/3.7/lib/python3.7/netrc.py", line 111, in _parse
   file, lexer.lineno)
   netrc.NetrcParseError: bad follower token 'method' (/Users/ian/.netrc, line 7)
2. ianwremmel

   added

   3.7 (EOL)end of lifeend of life

   on Oct 5, 2018
3. tirkarthi commented on Oct 5, 2018

   

   tirkarthi

   on Oct 5, 2018

   Member

   More actions

   Thanks for the report. There is no spec for .netrc files and the closest I can find is [0]. The error is present in master also. Could this be considered as an enhancement?

   [0] https://www.gnu.org/software/inetutils/manual/html_node/The-_002enetrc-file.html

   Thanks
4. ianwremmel commented on Oct 6, 2018

   

   ianwremmelmannequin

   on Oct 6, 2018

   MannequinAuthor

   More actions

   Yea, somehow, I suspected it was because there's no formal spec :)

   I guess technically it's an enhancement, but given that configuration dictated by third-parties can break the environment, it does feel like a bug.

   For example, I can't use a python app to authenticate to github via netrc because of how heroku says I have to configure my netrc.

   Also, there are probably two subtly different issues:

   1. a machine with a password but no login breaks parsing
   2. a machine with an unrecognized key breaks parsing

   👍React with 👍1Reacted by Rolando Garza
5. ianwremmel

   changed the title [-]netrc parding is overly strict[/-] [+]netrc parsing is overly strict[/+] on Oct 6, 2018
6. zhangyangyu commented on Oct 10, 2018

   

   zhangyangyu

   on Oct 10, 2018

   Member

   More actions

   My PR #127 has tried to solve some restrictions of the current netrc library. It's somewhat outdated since no reviewer for a long time. As you can see there are also other libraries suffering from the restrictions.

   Revising it I think it still doesn't solve the case here, although it should be easy. There is no formal spec we can refer to. :-( But since there is real world problem and curl allows it, we should take it into mind.
7. hober commented on Jun 17, 2020

   

   hobermannequin

   on Jun 17, 2020

   Mannequin

   More actions

   Emacs' netrc library supports some other keywords, namely 'port'. (This helps distinguish SMTP and IMAP auth information for the same machine.)

   Documentation is here: https://www.gnu.org/software/emacs/manual/html_node/auth/Help-for-users.html
8. terryjreedy

   added

   3.10 (EOL)end of lifeend of life

   and removed

   3.7 (EOL)end of lifeend of life

   on Jul 6, 2020
9. eamanu commented on May 28, 2021

   

   eamanumannequin

   on May 28, 2021

   Mannequin

   More actions

   Hellos,

   This issue is fixed via this PR[0] that is a continues from xiang.zhang work [1]

   [0] #26330
   [1] #127
10. ezio-melotti

    transferred this issue fromon Apr 10, 2022
11. hugovk

    closed this as completedon Oct 25, 2026