sonar-scm-tfvc icon indicating copy to clipboard operation
sonar-scm-tfvc copied to clipboard

Special characters in the password results in no password being sent to SonarTfsAnnotate.exe

Open artisan-jimmy opened this issue 2 years ago • 1 comments

I've noticed that having special characters causes the password to be sent as an empty string to SonarTfsAnnotate.exe. The password I've tested with contains the following special characters: #, ? and ( Not sure what character is the culprit, but I've verified this by modifying the SonarTfsAnnotate.exe by adding the following:

using (var sw = new StreamWriter("C:\\temp\\scm-tfvc.log", true))
{
    sw.WriteLine($"un: [{username}]");
    sw.WriteLine($"pw: [{password}]");
    sw.Flush();
}

artisan-jimmy avatar Aug 18 '23 06:08 artisan-jimmy

I've no idea why the mentioned characters may cause the described behavior. I myself do not recommend to use username and password. Please use PAT instead for security reasons. (The feature was implemented before I took ownership for this repo.)

So, if I invest time in this issue I would remove support for username/password. You are welcome to start more detailed analysis. A pull request is welcome.

lg2de avatar Dec 07 '23 09:12 lg2de