Skip to content

Fix panic when .netrc entry has no password#4444

Closed
aviu16 wants to merge 1 commit intoTabbyML:mainfrom
aviu16:fix-netrc-password-panic
Closed

Fix panic when .netrc entry has no password#4444
aviu16 wants to merge 1 commit intoTabbyML:mainfrom
aviu16:fix-netrc-password-panic

Conversation

@aviu16
Copy link

@aviu16 aviu16 commented Feb 15, 2026

Summary

Fixes a panic in get_credentials_from_netrc when a .netrc entry exists but has no password field.

Bug Description

In crates/aim-downloader/src/address.rs, the get_credentials_from_netrc function unconditionally unwraps machine.password:

if server == name {
    user.clone_from(&machine.login);
    pass = machine.password.clone().unwrap();  // Panics if password is None!
    break;
}

Crash Scenario

A .netrc file like this will cause a panic:

machine example.com
login myuser

When tabby tries to download from example.com, it finds the matching host in .netrc, but machine.password is None because no password was specified. The .unwrap() then panics.

Root Cause

The netrc crate's Machine struct has password: Option<String>, but the code assumes it's always Some.

Fix

Changed to use if let to only update the password if it exists:

if server == name {
    user.clone_from(&machine.login);
    if let Some(password) = &machine.password {
        pass = password.clone();
    }
    break;
}

If no password is in .netrc, the function now falls back to the password parameter (default: "anonymous").

Impact

  • Prevents panic when .netrc entries have login but no password
  • Maintains existing behavior: password parameter is used as fallback
  • Matches how login is handled (which doesn't unwrap since it's not Option<String>)

Testing

The fix allows .netrc files with password-less entries to work without crashing. The existing test cases continue to pass.

🤖 Generated with Claude Code

When a .netrc entry has no password field, machine.password is None
and unwrapping it causes a panic.

Changed to use if-let to only update password if it exists.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@wsxiaoys wsxiaoys requested a review from zwpaper February 15, 2026 08:57
@aviu16
Copy link
Author

aviu16 commented Feb 15, 2026

gonna close this one, realized i dont have bandwidth to follow up on review feedback rn. sorry about that!

@aviu16 aviu16 closed this Feb 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant