threads / patch / 25729

patchFix username and password extraction from HTTP URLs

Subject: [PATCH] Fix username and password extraction from HTTP URLs

## tl;dr

2 messages between Nov 12, 2010 and Nov 13, 2010. Diffs are folded; open one to read it.

replies: 1people: 2as markdown or json

Gabriel Corona· Nov 12, 2010, 23:20 UTC · lore

Change the authentification initialisation to percent-decode username and password for HTTP URLs.

Signed-off-by: Gabriel Corona <gabriel.corona@enst-bretagne.fr>
---
 http.c |   12 +++++++++++-
 1 files changed, 11 insertions(+), 1 deletions(-)
Show changes to http.c +11 −1
diff --git a/http.c b/http.c
index 0a5011f..c9393a8 100644
--- a/http.c
+++ b/http.c
@@ -2,6 +2,7 @@
 #include "pack.h"
 #include "sideband.h"
 #include "run-command.h"
+#include "url.h"
 
 int data_received;
 int active_requests;
@@ -297,7 +298,7 @@ static CURL *get_curl_handle(void)
 
 static void http_auth_init(const char *url)
 {
-	char *at, *colon, *cp, *slash;
+	char *at, *colon, *cp, *slash, *decoded;
 	int len;
 
 	cp = strstr(url, "://");
@@ -322,16 +323,25 @@ static void http_auth_init(const char *url)
 		user_name = xmalloc(len + 1);
 		memcpy(user_name, cp, len);
 		user_name[len] = '\0';
+		decoded = url_decode(user_name);
+		free(user_name);
+		user_name = decoded;
 		user_pass = NULL;
 	} else {
 		len = colon - cp;
 		user_name = xmalloc(len + 1);
 		memcpy(user_name, cp, len);
 		user_name[len] = '\0';
+		decoded = url_decode(user_name);
+		free(user_name);
+		user_name = decoded;
 		len = at - (colon + 1);
 		user_pass = xmalloc(len + 1);
 		memcpy(user_pass, colon + 1, len);
 		user_pass[len] = '\0';
+		decoded = url_decode(user_pass);
+		free(user_pass);
+		user_pass = decoded;
 	}
 }
 
-- 
1.7.2.3
Sverre Rabbelier· Nov 13, 2010, 21:33 UTC · re: Gabriel Corona · lore

Re: [PATCH] Fix username and password extraction from HTTP URLs

Heya,

On Sat, Nov 13, 2010 at 00:20, Gabriel Corona <gabriel.corona@enst-bretagne.fr> wrote:

> Change the authentification initialisation to percent-decode username
> and password for HTTP URLs.
Can has tests?
-- 
Cheers,

Sverre Rabbelier

← back to recent threads