Subject: bug#49289: 28.0.50; auth-source-search may return doubly obfuscated :secret value

From: Kazuhiro Ito <[email-masked]>
Date: Wed, 30 Jun 2021 19:18:37 +0900

When I have ~/.authinfo entry of 'mail.example.com' for user 'foo' but
not user 'bar',

~/.authinfo
machine mail.example.com login foo password abcdef

for user other than 'foo', auth-source-search returns a function which
returns a function which returns a string.

(progn
  (require 'auth-source)
  (list
   (funcall
    (plist-get
     (car (auth-source-search
	   :host "mail.example.com" :user "foo"
	   :require '(:secret) :create t))
     :secret))
   (funcall
    (funcall
     ;; *** funcall called twice. ***
     (plist-get
      (car (auth-source-search
	    :host "mail.example.com" :user "bar"
	    :require '(:secret) :create t))
      :secret)))))

-> ("abcdef" "abcdef")

I don't know whether auth-source supports multiple accounts on the
same host and whether it is a feature that auth-source-search tend to
return other user's password.  But I think doubly obfuscated :secret
value is obviously a bug.

-- 
Kazuhiro Ito