urldecode password field to allow passwords containing :/? #1508
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hi,
We recently ran into an issue, where we have a FTP password containing the
/character. This breaks the URL parsing with the current code.We could try to work around the issue with tweaks to the regex detection logic, but no matter what we do, some characters will still break it, as there has to be a way for our code to determine where each part of the URL stops.
The proposed (and implemented here) fix is to consider that since we're taking a URL as input and parsing it, we might as well rely on standard URL escaping to deal with any character susceptible from breaking URL parsing. As far as I can tell, the affected characters are (at least)
:/@#?%.This PR therefore reverts a good chunk of #1329, and adds an extra url decoding of the parsed values.
This is a breaking change, as characters that are currently accepted may need to be escaped with this new code. I'm not sure how you want to handle that, maybe a major version bump ? (Although, if you're willing to go with that, I have other breaking changes that I want to suggest, I'll open separate PRs for them as soon as I can)
Documentation updates are probably needed too, but I'd rather have your opinion on the topic before redacting anything !