Repository: rclone/rclone
File: backend/sftp/sftp.go (Go)

Code before:
			opt.KeyPem, err = strconv.Unquote("\"" + opt.KeyPem + "\"")
			if err != nil {
				return nil, fmt.Errorf("pem key not formatted properly: %w", err)
			}
			key = []byte(opt.KeyPem)
		}
		clearpass := ""
		if opt.KeyFilePass != "" {
			clearpass, err = obscure.Reveal(opt.KeyFilePass)
			if err != nil {
				return nil, err
			}
		}
		var signer ssh.Signer
		if clearpass == "" {
			signer, err = ssh.ParsePrivateKey(key)
		} else {
			signer, err = ssh.ParsePrivateKeyWithPassphrase(key, []byte(clearpass))
		}
		if err != nil {
			return nil, fmt.Errorf("failed to parse private key file: %w", err)
		}

		// If a public key has been specified then use that
		if pubkeyFile != "" || pubKey != "" {
			pubKeyRaw := []byte(pubKey)
			// Use this error if public key is provided inline and is not a certificate
			// if public key file is provided instead, use the err in the if block
			notACertError := errors.New("public key provided is not a certificate: " + pubKey)
			if pubKey == "" {
				notACertError = errors.New("public key file is not a certificate file: " + pubkeyFile)
				err := error(nil)
				pubKeyRaw, err = os.ReadFile(pubkeyFile)
				if err != nil {
					return nil, fmt.Errorf("unable to read cert file: %w", err)
				}
			}

			pk, _, _, _, err := ssh.ParseAuthorizedKey(pubKeyRaw)
			if err != nil {
				return nil, fmt.Errorf("unable to parse cert file: %w", err)
			}

			// And the signer for this, which includes the private key signer
			// This is what we'll pass to the ssh client.
			// Normally the ssh client will use the public key built
			// into the private key, but we need to tell it to use the user
			// specified public key cert.  This signer is specific to the
			// cert and will include the private key signer.  Now ssh
			// knows everything it needs.
			cert, ok := pk.(*ssh.Certificate)

Review comment (security):
Should it use `strconv.Unquote` the same way as is done for `opt.KeyPem` above, which I'm assuming is to handle backslash escaped special characters?

Code after:
			if err != nil {
				return nil, fmt.Errorf("pem key not formatted properly: %w", err)
			}
			key = []byte(opt.KeyPem)
		}
		clearpass := ""
		if opt.KeyFilePass != "" {
			clearpass, err = obscure.Reveal(opt.KeyFilePass)
			if err != nil {
				return nil, err
			}
		}
		var signer ssh.Signer
		if clearpass == "" {
			signer, err = ssh.ParsePrivateKey(key)
		} else {
			signer, err = ssh.ParsePrivateKeyWithPassphrase(key, []byte(clearpass))
		}
		if err != nil {
			return nil, fmt.Errorf("failed to parse private key file: %w", err)
		}

		// If a public key has been specified then use that
		if pubkeyFile != "" || opt.PubKey != "" {
			pubKeyRaw := []byte(opt.PubKey)
			// Use this error if public key is provided inline and is not a certificate
			// if public key file is provided instead, use the err in the if block
			notACertError := errors.New("public key provided is not a certificate: " + opt.PubKey)
			if opt.PubKey == "" {
				notACertError = errors.New("public key file is not a certificate file: " + pubkeyFile)
				err := error(nil)
				pubKeyRaw, err = os.ReadFile(pubkeyFile)
				if err != nil {
					return nil, fmt.Errorf("unable to read cert file: %w", err)
				}
			}

			pk, _, _, _, err := ssh.ParseAuthorizedKey(pubKeyRaw)
			if err != nil {
				return nil, fmt.Errorf("unable to parse cert file: %w", err)
			}

			// And the signer for this, which includes the private key signer
			// This is what we'll pass to the ssh client.
			// Normally the ssh client will use the public key built
			// into the private key, but we need to tell it to use the user
			// specified public key cert.  This signer is specific to the
			// cert and will include the private key signer.  Now ssh
			// knows everything it needs.
			cert, ok := pk.(*ssh.Certificate)
			if !ok {