chocolatey / chocolatey/choco

Credential change not detected if the change is only in the case

Open
#3,543 0 comments 0 reactions 0 assignees View on GitHub
0 - Backlog Bug
Dominant language
C#
Stars
11.5k
Forks
960
PR merge metrics
No merged PRs in 30d

Description

### Checklist

- [x] I confirm there are no unresolved issues reported on the [Chocolatey Status page](https://status.chocolatey.org).
- [x] I have verified this is the correct repository for opening this issue.
- [x] I have verified no other issues exist related to my problem.
- [x] I have verified this is not an issue for a specific package.
- [x] I have verified this issue is not security related.
- [x] I confirm I am using **official**, and **not** unofficial, or modified, Chocolatey products.

### What You Are Seeing?

Authenticated sources that require correction of incorrectly cased usernames or passwords will not update the values, because Chocolatey CLI converts the string to lower-case before comparing it.

This can be an issue on, for instance, Nexus, where the username is case sensitive.

### What is Expected?

Chocolatey CLI should update the value if it is different, even if all the letters match.

### How Did You Get This To Happen?

1. Install Chocolatey CLI: `irm https://ch0.co/go | iex`
2. Add an authenticated source to your install: `choco source add --name='test' --source='https://example.com/api/v2/' --username='bob' --password='bob1999'`
3. Realising you should have capitalised 'Bob', attempt to update your source: `choco source add --name='test' --source='https://example.com/api/v2/' --username='Bob' --password='bob1999'` or password: `choco source add --name='test' --source='https://example.com/api/v2/' --username='bob' --password='BOB1999'`

Results in: `Nothing to change. Config already set.`

![Image](https://github.com/user-attachments/assets/2ceaf681-a8dc-436f-9fa9-0e84cd9088ae)

### System Details

- Operating System: Windows 11
- Windows PowerShell Version: 5
- Chocolatey CLI Version: 2.3
- Chocolatey Licensed Extension version: 6.3
- Chocolatey License type (Professional / Business / ?): Business
- Terminal/Emulator: Windows Terminal

### Installed Packages

N/A

### Output Log

N/A

### Additional Context

## Workaround
1. Set the password or username to something that doesn't insensitively match the previous value, e.g. 'helen1999'.
2. Change it back to the correctly cased original value.

(similar to working with Windows filenames)

## Proposed Solution
`Source` [checks the values](https://github.com/chocolatey/choco/blob/develop/src/chocolatey/infrastructure.app/services/ChocolateyConfigSettingsService.cs#L150-L151) and says no changes needed. This is because we specifically use `ignoreCase: true` [in `IsEqualTo`](https://github.com/chocolatey/choco/blob/develop/src/chocolatey/StringExtensions.cs#L252)

I guess my recommended fix would be to either add an IsEqualToSensitive or to add a parameter to the existing method for ignoreCase that defaults to true. That shouldn't break things, but I haven't investigated all uses of `IsEqualTo()` in the codebase.

Contributor guide

Open the contributing guide

Research direction

Start with ChocolateyConfigSettingsService.cs around lines 150-151 and StringExtensions.cs around line 252, then trace the Source comparison entry point. Confirm how case-only username and password changes are evaluated and identify the relevant existing configuration tests. Done means the CLI recognizes case-only credential changes rather than reporting "Config already set."

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.