Erlang/OTP Forums

Author Message

<  Erlang patches mailing list  ~  problem with ":" in http passwords

Guest
Posted: Tue May 18, 2010 1:43 pm Reply with quote
Guest
Hi,

I was trying to do something along the lines of

http:request("http://foo:bar:bee:bop@dedasys.com"), where, in theory,
'foo' is the username, and the rest is a password, but that causes
problems - try it for yourself and see what sort of headers it
generates.

This patch seems to fix it, but I can't be 100% sure since doing make
release_tests "doesn't work" (doesn't even start running tests) here.
It should be pretty simple to ascertain, though.

lib/inets/src/http_client/httpc_request.erl | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/inets/src/http_client/httpc_request.erl
b/lib/inets/src/http_client/httpc_request.erl
index 55e0af4..e64d87a 100644
--- a/lib/inets/src/http_client/httpc_request.erl
+++ b/lib/inets/src/http_client/httpc_request.erl
@@ -236,8 +236,8 @@ handle_user_info([], Headers) ->
Headers;
handle_user_info(UserInfo, Headers) ->
case string:tokens(UserInfo, ":") of
- [User, Passwd] ->
- UserPasswd = base64:encode_to_string(User ++ ":" ++ Passwd),
+ [User | Rest] ->
+ UserPasswd = base64:encode_to_string(User ++ ":" ++
string:join(Rest, ":")),
Headers#http_request_h{authorization = "Basic " ++ UserPasswd};
[User] ->
UserPasswd = base64:encode_to_string(User ++ ":"),
--
1.6.3.3


Thanks,
--
David N. Welton

http://www.welton.it/davidw/

http://www.dedasys.com/

________________________________________________________________
erlang-patches (at) erlang.org mailing list.
See http://www.erlang.org/faq.html
To unsubscribe; mailto:erlang-patches-unsubscribe@erlang.org

Post received from mailinglist
Guest
Posted: Tue May 18, 2010 1:43 pm Reply with quote
Guest
Hi,

I was trying to do something along the lines of

http:request("http://foo:bar:bee:bop@dedasys.com"), where, in theory,
'foo' is the username, and the rest is a password, but that causes
problems - try it for yourself and see what sort of headers it
generates.

This patch seems to fix it, but I can't be 100% sure since doing make
release_tests "doesn't work" (doesn't even start running tests) here.
It should be pretty simple to ascertain, though.

lib/inets/src/http_client/httpc_request.erl | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/inets/src/http_client/httpc_request.erl
b/lib/inets/src/http_client/httpc_request.erl
index 55e0af4..e64d87a 100644
--- a/lib/inets/src/http_client/httpc_request.erl
+++ b/lib/inets/src/http_client/httpc_request.erl
@@ -236,8 +236,8 @@ handle_user_info([], Headers) ->
Headers;
handle_user_info(UserInfo, Headers) ->
case string:tokens(UserInfo, ":") of
- [User, Passwd] ->
- UserPasswd = base64:encode_to_string(User ++ ":" ++ Passwd),
+ [User | Rest] ->
+ UserPasswd = base64:encode_to_string(User ++ ":" ++
string:join(Rest, ":")),
Headers#http_request_h{authorization = "Basic " ++ UserPasswd};
[User] ->
UserPasswd = base64:encode_to_string(User ++ ":"),
--
1.6.3.3


Thanks,
--
David N. Welton

http://www.welton.it/davidw/

http://www.dedasys.com/

________________________________________________________________
erlang-patches (at) erlang.org mailing list.
See http://www.erlang.org/faq.html
To unsubscribe; mailto:erlang-patches-unsubscribe@erlang.org

Post received from mailinglist
Guest
Posted: Tue May 18, 2010 2:56 pm Reply with quote
Guest
On Tue, May 18, 2010 at 03:42:11PM +0200, David Welton wrote:
> Hi,
>
> I was trying to do something along the lines of
>
> http:request("http://foo:bar:bee:bop@dedasys.com"), where, in theory,
> 'foo' is the username, and the rest is a password, but that causes
> problems - try it for yourself and see what sort of headers it
> generates.

Looking at RFC 1738:

The user name (and password), if present, are followed by a commercial
at-sign "@". Within the user and password field, any ":", "@", or "/"
must be encoded.

See: http://www.faqs.org/rfcs/rfc1738.html

Maybe try:

edoc_lib:escape_uri("my:pass").


> This patch seems to fix it, but I can't be 100% sure since doing make
> release_tests "doesn't work" (doesn't even start running tests) here.
> It should be pretty simple to ascertain, though.
>
> lib/inets/src/http_client/httpc_request.erl | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/lib/inets/src/http_client/httpc_request.erl
> b/lib/inets/src/http_client/httpc_request.erl
> index 55e0af4..e64d87a 100644
> --- a/lib/inets/src/http_client/httpc_request.erl
> +++ b/lib/inets/src/http_client/httpc_request.erl
> @@ -236,8 +236,8 @@ handle_user_info([], Headers) ->
> Headers;
> handle_user_info(UserInfo, Headers) ->
> case string:tokens(UserInfo, ":") of
> - [User, Passwd] ->
> - UserPasswd = base64:encode_to_string(User ++ ":" ++ Passwd),
> + [User | Rest] ->
> + UserPasswd = base64:encode_to_string(User ++ ":" ++
> string:join(Rest, ":")),
> Headers#http_request_h{authorization = "Basic " ++ UserPasswd};
> [User] ->
> UserPasswd = base64:encode_to_string(User ++ ":"),
> --
> 1.6.3.3
>
>
> Thanks,
> --
> David N. Welton
>
> http://www.welton.it/davidw/
>
> http://www.dedasys.com/
>
> ________________________________________________________________
> erlang-patches (at) erlang.org mailing list.
> See http://www.erlang.org/faq.html
> To unsubscribe; mailto:erlang-patches-unsubscribe@erlang.org
>

________________________________________________________________
erlang-patches (at) erlang.org mailing list.
See http://www.erlang.org/faq.html
To unsubscribe; mailto:erlang-patches-unsubscribe@erlang.org

Post received from mailinglist
Guest
Posted: Tue May 18, 2010 2:57 pm Reply with quote
Guest
On Tue, May 18, 2010 at 03:42:11PM +0200, David Welton wrote:
> Hi,
>
> I was trying to do something along the lines of
>
> http:request("http://foo:bar:bee:bop@dedasys.com"), where, in theory,
> 'foo' is the username, and the rest is a password, but that causes
> problems - try it for yourself and see what sort of headers it
> generates.

Looking at RFC 1738:

The user name (and password), if present, are followed by a commercial
at-sign "@". Within the user and password field, any ":", "@", or "/"
must be encoded.

See: http://www.faqs.org/rfcs/rfc1738.html

Maybe try:

edoc_lib:escape_uri("my:pass").


> This patch seems to fix it, but I can't be 100% sure since doing make
> release_tests "doesn't work" (doesn't even start running tests) here.
> It should be pretty simple to ascertain, though.
>
> lib/inets/src/http_client/httpc_request.erl | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/lib/inets/src/http_client/httpc_request.erl
> b/lib/inets/src/http_client/httpc_request.erl
> index 55e0af4..e64d87a 100644
> --- a/lib/inets/src/http_client/httpc_request.erl
> +++ b/lib/inets/src/http_client/httpc_request.erl
> @@ -236,8 +236,8 @@ handle_user_info([], Headers) ->
> Headers;
> handle_user_info(UserInfo, Headers) ->
> case string:tokens(UserInfo, ":") of
> - [User, Passwd] ->
> - UserPasswd = base64:encode_to_string(User ++ ":" ++ Passwd),
> + [User | Rest] ->
> + UserPasswd = base64:encode_to_string(User ++ ":" ++
> string:join(Rest, ":")),
> Headers#http_request_h{authorization = "Basic " ++ UserPasswd};
> [User] ->
> UserPasswd = base64:encode_to_string(User ++ ":"),
> --
> 1.6.3.3
>
>
> Thanks,
> --
> David N. Welton
>
> http://www.welton.it/davidw/
>
> http://www.dedasys.com/
>
> ________________________________________________________________
> erlang-patches (at) erlang.org mailing list.
> See http://www.erlang.org/faq.html
> To unsubscribe; mailto:erlang-patches-unsubscribe@erlang.org
>

________________________________________________________________
erlang-patches (at) erlang.org mailing list.
See http://www.erlang.org/faq.html
To unsubscribe; mailto:erlang-patches-unsubscribe@erlang.org

Post received from mailinglist
Guest
Posted: Wed May 19, 2010 12:06 pm Reply with quote
Guest
>> I was trying to do something along the lines of
>>
>> http:request("http://foo:bar:bee:bop@dedasys.com"), where, in theory,
>> 'foo' is the username, and the rest is a password, but that causes
>> problems - try it for yourself and see what sort of headers it
>> generates.
>
> Looking at RFC 1738:
>
> The user name (and password), if present, are followed by a commercial
> at-sign "@". Within the user and password field, any ":", "@", or "/"
> must be encoded.
>
> See: http://www.faqs.org/rfcs/rfc1738.html
>
> Maybe try:
>
>
Guest
Posted: Wed May 19, 2010 12:06 pm Reply with quote
Guest
>> I was trying to do something along the lines of
>>
>> http:request("http://foo:bar:bee:bop@dedasys.com"), where, in theory,
>> 'foo' is the username, and the rest is a password, but that causes
>> problems - try it for yourself and see what sort of headers it
>> generates.
>
> Looking at RFC 1738:
>
> The user name (and password), if present, are followed by a commercial
> at-sign "@". Within the user and password field, any ":", "@", or "/"
> must be encoded.
>
> See: http://www.faqs.org/rfcs/rfc1738.html
>
> Maybe try:
>
>

Display posts from previous:  

All times are GMT
Page 1 of 1
This forum is locked: you cannot post, reply to, or edit topics.

Jump to:  

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum