Re: Cloning enterprise github repo with cygwin git tries to use username/password auth, have to use Windows git

2025-02-10 Thread Andrey Repin via Cygwin
Greetings, KARR, DAVID! > I'm now trying to connect to our new enterprise Github repositories. I > have created a PAT in Github. I've verified that it works by testing it with > some code using the github rest api. Until now, I haven't attempted a clone > from the new repositories or pushing to

Re: Potential Argument Injection Issue in Cygwin's Command Line Handling

2025-02-10 Thread Kaz Kylheku via Cygwin
On 2025-02-03 22:15, Splitline Huang via Cygwin wrote: > Hello Cygwin team, > > I am splitline from DEVCORE research team. I recently have observed an > inconsistency > in how Cygwin handles command-line parsing compared to Microsoft’s > implementation. Hi, I maintain a small fork of the Cygwin

Re: Potential Argument Injection Issue in Cygwin's Command Line Handling

2025-02-10 Thread Brian Inglis via Cygwin
On 2025-02-09 20:48, Splitline Ng via Cygwin wrote: Windows is security deficient in this area, not Cygwin. I'll quote myself to share my opinion: https://git.lighttpd.net/lighttpd/lighttpd1.4/src/branch/master/src/fdevent_win32.c#L543 * The Microsoft CreateProcess() interface is criminall

Re: Potential Argument Injection Issue in Cygwin's Command Line Handling

2025-02-10 Thread Kaz Kylheku via Cygwin
On 2025-02-10 12:32, Brian Inglis via Cygwin wrote: > One can avoid any issues by running Cygwin programs only from other Cygwin > programs, and Windows programs only from other Windows programs. Microsoft has provided a documented algorithm, which is implemented in the ShellAPI function Command