{"thread":{"id":"25739","subject":"[PATCHv2 2/2] Fix username and password extraction from HTTP URLs","startedAt":"2010-11-14T01:51:13Z","lastAt":"2010-11-14T12:27:50Z","messageCount":4,"participants":["Gabriel Corona","Tay Ray Chuan"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"155838","messageId":"1289699475-11364-1-git-send-email-gabriel.corona@enst-bretagne.fr","threadId":"25739","inReplyTo":null,"subject":"[PATCHv2 0/2] Fix username and password extraction from HTTP URLs","fromName":"Gabriel Corona","fromEmail":"gabriel.corona@enst-bretagne.fr","sentAt":"2010-11-14T01:51:13Z","receivedAt":"2010-11-14T01:51:13Z","isPatch":false,"sender":{"key":"gabriel.corona@enst-bretagne.fr","avatar":null},"body":"Percent-decode username and password in HTTP URLs. This is necessary\nto specify a username with a '@' character in the URL.\n\nGabriel Corona (2):\n t5550: test HTTP authentication and userinfo decoding\n Fix username and password extraction from HTTP URLs\n\n http.c | 12 +++++++++++-\n t/lib-httpd.sh | 3 +++\n t/lib-httpd/apache.conf | 29 +++++++++++++++++++++++++++++\n t/lib-httpd/passwd | 1 +\n t/t5550-http-fetch.sh | 7 +++++++\n 5 files changed, 51 insertions(+), 1 deletions(-)\n create mode 100644 t/lib-httpd/passwd\n\n-- \n1.7.2.3\n"},{"id":"155839","messageId":"1289699475-11364-2-git-send-email-gabriel.corona@enst-bretagne.fr","threadId":"25739","inReplyTo":"1289699475-11364-1-git-send-email-gabriel.corona@enst-bretagne.fr","subject":"[PATCHv2 1/2] t5550: test HTTP authentication and userinfo decoding","fromName":"Gabriel Corona","fromEmail":"gabriel.corona@enst-bretagne.fr","sentAt":"2010-11-14T01:51:14Z","receivedAt":"2010-11-14T01:51:14Z","isPatch":false,"sender":{"key":"gabriel.corona@enst-bretagne.fr","avatar":null},"body":"Add a test for HTTP authentication and proper percent-decoding of the\nuserinfo (username and password) part of the URL.\n\nSigned-off-by: Gabriel Corona \n---\n t/lib-httpd.sh | 3 +++\n t/lib-httpd/apache.conf | 29 +++++++++++++++++++++++++++++\n t/lib-httpd/passwd | 1 +\n t/t5550-http-fetch.sh | 7 +++++++\n 4 files changed, 40 insertions(+), 0 deletions(-)\n create mode 100644 t/lib-httpd/passwd\n\ndiff --git a/t/lib-httpd.sh b/t/lib-httpd.sh\nindex e733f65..3f24384 100644\n--- a/t/lib-httpd.sh\n+++ b/t/lib-httpd.sh\n@@ -75,12 +75,14 @@ fi\n \n prepare_httpd() {\n \tmkdir -p \"$HTTPD_DOCUMENT_ROOT_PATH\"\n+\tcp \"$TEST_PATH\"/passwd \"$HTTPD_ROOT_PATH\"\n \n \tln -s \"$LIB_HTTPD_MODULE_PATH\" \"$HTTPD_ROOT_PATH/modules\"\n \n \tif test -n \"$LIB_HTTPD_SSL\"\n \tthen\n \t\tHTTPD_URL=https://127.0.0.1:$LIB_HTTPD_PORT\n+\t\tAUTH_HTTPD_URL=https://user%40host:user%40host@127.0.0.1:$LIB_HTTPD_PORT\n \n \t\tRANDFILE_PATH=\"$HTTPD_ROOT_PATH\"/.rnd openssl req \\\n \t\t\t-config \"$TEST_PATH/ssl.cnf\" \\\n@@ -92,6 +94,7 @@ prepare_httpd() {\n \t\tHTTPD_PARA=\"$HTTPD_PARA -DSSL\"\n \telse\n \t\tHTTPD_URL=http://127.0.0.1:$LIB_HTTPD_PORT\n+\t\tAUTH_HTTPD_URL=http://user%40host:user%40host@127.0.0.1:$LIB_HTTPD_PORT\n \tfi\n \n \tif test -n \"$LIB_HTTPD_DAV\" -o -n \"$LIB_HTTPD_SVN\"\ndiff --git a/t/lib-httpd/apache.conf b/t/lib-httpd/apache.conf\nindex 4961505..b40e43b 100644\n--- a/t/lib-httpd/apache.conf\n+++ b/t/lib-httpd/apache.conf\n@@ -17,8 +17,30 @@ ErrorLog error.log\n \n \tLoadModule env_module modules/mod_env.so\n \n+\n+\tLoadModule version_module modules/mod_version.so\n+\n+\n+\n+\n+\tLoadModule auth_module modules/mod_auth.so\n+\n+\n+\n+= 2.1>\n+\n+\tLoadModule auth_basic_module modules/mod_auth_basic.so\n+\n+\n+\tLoadModule authn_file_module modules/mod_authn_file.so\n+\n+\n+\tLoadModule authz_user_module modules/mod_authz_user.so\n+\n+\n \n Alias /dumb/ www/\n+Alias /auth/ www/auth/\n \n \n \tSetEnv GIT_EXEC_PATH ${GIT_EXEC_PATH}\n@@ -48,6 +70,13 @@ SSLMutex file:ssl_mutex\n SSLEngine On\n \n \n+\n+\tAuthType Basic\n+\tAuthName \"git-auth\"\n+\tAuthUserFile passwd\n+\tRequire valid-user\n+\n+\n \n \tLoadModule dav_module modules/mod_dav.so\n \tLoadModule dav_fs_module modules/mod_dav_fs.so\ndiff --git a/t/lib-httpd/passwd b/t/lib-httpd/passwd\nnew file mode 100644\nindex 0000000..f2fbcad\n--- /dev/null\n+++ b/t/lib-httpd/passwd\n@@ -0,0 +1 @@\n+user@host:nKpa8pZUHx/ic\ndiff --git a/t/t5550-http-fetch.sh b/t/t5550-http-fetch.sh\nindex 2fb48d0..a0564de 100755\n--- a/t/t5550-http-fetch.sh\n+++ b/t/t5550-http-fetch.sh\n@@ -34,6 +34,13 @@ test_expect_success 'clone http repository' '\n \ttest_cmp file clone/file\n '\n \n+test_expect_failure 'clone http repository with authentication' '\n+\tmkdir \"$HTTPD_DOCUMENT_ROOT_PATH/auth/\" &&\n+\tcp -Rf \"$HTTPD_DOCUMENT_ROOT_PATH/repo.git\" \"$HTTPD_DOCUMENT_ROOT_PATH/auth/repo.git\" &&\n+\tgit clone $AUTH_HTTPD_URL/auth/repo.git clone-auth &&\n+\ttest_cmp file clone-auth/file\n+'\n+\n test_expect_success 'fetch changes via http' '\n \techo content >>file &&\n \tgit commit -a -m two &&\n-- \n1.7.2.3\n"},{"id":"155837","messageId":"1289699475-11364-3-git-send-email-gabriel.corona@enst-bretagne.fr","threadId":"25739","inReplyTo":"1289699475-11364-1-git-send-email-gabriel.corona@enst-bretagne.fr","subject":"[PATCHv2 2/2] Fix username and password extraction from HTTP URLs","fromName":"Gabriel Corona","fromEmail":"gabriel.corona@enst-bretagne.fr","sentAt":"2010-11-14T01:51:15Z","receivedAt":"2010-11-14T01:51:15Z","isPatch":false,"sender":{"key":"gabriel.corona@enst-bretagne.fr","avatar":null},"body":"Change the authentification initialisation to percent-decode username\nand password for HTTP URLs.\n\nSigned-off-by: Gabriel Corona \n---\n http.c | 12 +++++++++++-\n t/t5550-http-fetch.sh | 2 +-\n 2 files changed, 12 insertions(+), 2 deletions(-)\n\ndiff --git a/http.c b/http.c\nindex 0a5011f..c9393a8 100644\n--- a/http.c\n+++ b/http.c\n@@ -2,6 +2,7 @@\n #include \"pack.h\"\n #include \"sideband.h\"\n #include \"run-command.h\"\n+#include \"url.h\"\n \n int data_received;\n int active_requests;\n@@ -297,7 +298,7 @@ static CURL *get_curl_handle(void)\n \n static void http_auth_init(const char *url)\n {\n-\tchar *at, *colon, *cp, *slash;\n+\tchar *at, *colon, *cp, *slash, *decoded;\n \tint len;\n \n \tcp = strstr(url, \"://\");\n@@ -322,16 +323,25 @@ static void http_auth_init(const char *url)\n \t\tuser_name = xmalloc(len + 1);\n \t\tmemcpy(user_name, cp, len);\n \t\tuser_name[len] = '\\0';\n+\t\tdecoded = url_decode(user_name);\n+\t\tfree(user_name);\n+\t\tuser_name = decoded;\n \t\tuser_pass = NULL;\n \t} else {\n \t\tlen = colon - cp;\n \t\tuser_name = xmalloc(len + 1);\n \t\tmemcpy(user_name, cp, len);\n \t\tuser_name[len] = '\\0';\n+\t\tdecoded = url_decode(user_name);\n+\t\tfree(user_name);\n+\t\tuser_name = decoded;\n \t\tlen = at - (colon + 1);\n \t\tuser_pass = xmalloc(len + 1);\n \t\tmemcpy(user_pass, colon + 1, len);\n \t\tuser_pass[len] = '\\0';\n+\t\tdecoded = url_decode(user_pass);\n+\t\tfree(user_pass);\n+\t\tuser_pass = decoded;\n \t}\n }\n \ndiff --git a/t/t5550-http-fetch.sh b/t/t5550-http-fetch.sh\nindex a0564de..8c2ac35 100755\n--- a/t/t5550-http-fetch.sh\n+++ b/t/t5550-http-fetch.sh\n@@ -34,7 +34,7 @@ test_expect_success 'clone http repository' '\n \ttest_cmp file clone/file\n '\n \n-test_expect_failure 'clone http repository with authentication' '\n+test_expect_success 'clone http repository with authentication' '\n \tmkdir \"$HTTPD_DOCUMENT_ROOT_PATH/auth/\" &&\n \tcp -Rf \"$HTTPD_DOCUMENT_ROOT_PATH/repo.git\" \"$HTTPD_DOCUMENT_ROOT_PATH/auth/repo.git\" &&\n \tgit clone $AUTH_HTTPD_URL/auth/repo.git clone-auth &&\n-- \n1.7.2.3\n"},{"id":"155844","messageId":"AANLkTi=WPyDOtcfNhzgkmekkT6vPwBR3OM5Z83XkSaSq@mail.gmail.com","threadId":"25739","inReplyTo":"1289699475-11364-1-git-send-email-gabriel.corona@enst-bretagne.fr","subject":"Re: [PATCHv2 0/2] Fix username and password extraction from HTTP URLs","fromName":"Tay Ray Chuan","fromEmail":"rctay89@gmail.com","sentAt":"2010-11-14T12:27:50Z","receivedAt":"2010-11-14T12:27:50Z","isPatch":false,"sender":{"key":"rctay89@gmail.com","avatar":"https://avatars.githubusercontent.com/u/61553?v=4"},"body":"On Sun, Nov 14, 2010 at 9:51 AM, Gabriel Corona\n wrote:\n> Percent-decode username and password in HTTP URLs. This is necessary\n> to specify a username with a '@' character in the URL.\n>\n> Gabriel Corona (2):\n>  t5550: test HTTP authentication and userinfo decoding\n>  Fix username and password extraction from HTTP URLs\n>\n>  http.c                  |   12 +++++++++++-\n>  t/lib-httpd.sh          |    3 +++\n>  t/lib-httpd/apache.conf |   29 +++++++++++++++++++++++++++++\n>  t/lib-httpd/passwd      |    1 +\n>  t/t5550-http-fetch.sh   |    7 +++++++\n>  5 files changed, 51 insertions(+), 1 deletions(-)\n>  create mode 100644 t/lib-httpd/passwd\n\nAlthough the esotericity of having non-alphanumeric symbols in user\nnames escapes me, both look good.\n\n Acked-by: Tay Ray Chuan \n\n-- \nCheers,\nRay Chuan\n"}]}