[PATCHv2 0/2] Fix username and password extraction from HTTP URLs

4 messages, 2 authors, 2016-06-15 · open the first message on its own page

[PATCHv2 0/2] Fix username and password extraction from HTTP URLs

From: Gabriel Corona <hidden>
Date: 2016-06-15 22:50:02

Percent-decode username and password in HTTP URLs. This is necessary
to specify a username with a '@' character in the URL.

Gabriel Corona (2):
  t5550: test HTTP authentication and userinfo decoding
  Fix username and password extraction from HTTP URLs

 http.c                  |   12 +++++++++++-
 t/lib-httpd.sh          |    3 +++
 t/lib-httpd/apache.conf |   29 +++++++++++++++++++++++++++++
 t/lib-httpd/passwd      |    1 +
 t/t5550-http-fetch.sh   |    7 +++++++
 5 files changed, 51 insertions(+), 1 deletions(-)
 create mode 100644 t/lib-httpd/passwd

-- 
1.7.2.3

[PATCHv2 2/2] Fix username and password extraction from HTTP URLs

From: Gabriel Corona <hidden>
Date: 2016-06-15 22:50:02

Change the authentification initialisation to percent-decode username
and password for HTTP URLs.

Signed-off-by: Gabriel Corona <redacted>
---
 http.c                |   12 +++++++++++-
 t/t5550-http-fetch.sh |    2 +-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/http.c b/http.c
index 0a5011f..c9393a8 100644
--- a/http.c
+++ b/http.c

@@ -2,6 +2,7 @@
 #include "pack.h"
 #include "sideband.h"
 #include "run-command.h"
+#include "url.h"
 
 int data_received;
 int active_requests;

@@ -297,7 +298,7 @@ static CURL *get_curl_handle(void)
 
 static void http_auth_init(const char *url)
 {
-	char *at, *colon, *cp, *slash;
+	char *at, *colon, *cp, *slash, *decoded;
 	int len;
 
 	cp = strstr(url, "://");

@@ -322,16 +323,25 @@ static void http_auth_init(const char *url)
 		user_name = xmalloc(len + 1);
 		memcpy(user_name, cp, len);
 		user_name[len] = '\0';
+		decoded = url_decode(user_name);
+		free(user_name);
+		user_name = decoded;
 		user_pass = NULL;
 	} else {
 		len = colon - cp;
 		user_name = xmalloc(len + 1);
 		memcpy(user_name, cp, len);
 		user_name[len] = '\0';
+		decoded = url_decode(user_name);
+		free(user_name);
+		user_name = decoded;
 		len = at - (colon + 1);
 		user_pass = xmalloc(len + 1);
 		memcpy(user_pass, colon + 1, len);
 		user_pass[len] = '\0';
+		decoded = url_decode(user_pass);
+		free(user_pass);
+		user_pass = decoded;
 	}
 }

diff --git a/t/t5550-http-fetch.sh b/t/t5550-http-fetch.sh
index a0564de..8c2ac35 100755
--- a/t/t5550-http-fetch.sh
+++ b/t/t5550-http-fetch.sh

@@ -34,7 +34,7 @@ test_expect_success 'clone http repository' '
 	test_cmp file clone/file
 '
 
-test_expect_failure 'clone http repository with authentication' '
+test_expect_success 'clone http repository with authentication' '
 	mkdir "$HTTPD_DOCUMENT_ROOT_PATH/auth/" &&
 	cp -Rf "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" "$HTTPD_DOCUMENT_ROOT_PATH/auth/repo.git" &&
 	git clone $AUTH_HTTPD_URL/auth/repo.git clone-auth &&

-- 
1.7.2.3

[PATCHv2 1/2] t5550: test HTTP authentication and userinfo decoding

From: Gabriel Corona <hidden>
Date: 2016-06-15 22:50:02

Add a test for HTTP authentication and proper percent-decoding of the
userinfo (username and password) part of the URL.

Signed-off-by: Gabriel Corona <redacted>
---
 t/lib-httpd.sh          |    3 +++
 t/lib-httpd/apache.conf |   29 +++++++++++++++++++++++++++++
 t/lib-httpd/passwd      |    1 +
 t/t5550-http-fetch.sh   |    7 +++++++
 4 files changed, 40 insertions(+), 0 deletions(-)
 create mode 100644 t/lib-httpd/passwd

diff --git a/t/lib-httpd.sh b/t/lib-httpd.sh
index e733f65..3f24384 100644
--- a/t/lib-httpd.sh
+++ b/t/lib-httpd.sh

@@ -75,12 +75,14 @@ fi
 
 prepare_httpd() {
 	mkdir -p "$HTTPD_DOCUMENT_ROOT_PATH"
+	cp "$TEST_PATH"/passwd "$HTTPD_ROOT_PATH"
 
 	ln -s "$LIB_HTTPD_MODULE_PATH" "$HTTPD_ROOT_PATH/modules"
 
 	if test -n "$LIB_HTTPD_SSL"
 	then
 		HTTPD_URL=https://127.0.0.1:$LIB_HTTPD_PORT
+		AUTH_HTTPD_URL=https://user%40host:user%40host@127.0.0.1:$LIB_HTTPD_PORT
 
 		RANDFILE_PATH="$HTTPD_ROOT_PATH"/.rnd openssl req \
 			-config "$TEST_PATH/ssl.cnf" \

@@ -92,6 +94,7 @@ prepare_httpd() {
 		HTTPD_PARA="$HTTPD_PARA -DSSL"
 	else
 		HTTPD_URL=http://127.0.0.1:$LIB_HTTPD_PORT
+		AUTH_HTTPD_URL=http://user%40host:user%40host@127.0.0.1:$LIB_HTTPD_PORT
 	fi
 
 	if test -n "$LIB_HTTPD_DAV" -o -n "$LIB_HTTPD_SVN"

diff --git a/t/lib-httpd/apache.conf b/t/lib-httpd/apache.conf
index 4961505..b40e43b 100644
--- a/t/lib-httpd/apache.conf
+++ b/t/lib-httpd/apache.conf

@@ -17,8 +17,30 @@ ErrorLog error.log
 <IfModule !mod_env.c>
 	LoadModule env_module modules/mod_env.so
 </IfModule>
+<IfModule !mod_version.c>
+	LoadModule version_module modules/mod_version.so
+</IfModule>
+
+<IfVersion < 2.1>
+<IfModule !mod_auth.c>
+	LoadModule auth_module modules/mod_auth.so
+</IfModule>
+</IfVersion>
+
+<IfVersion >= 2.1>
+<IfModule !mod_auth_basic.c>
+	LoadModule auth_basic_module modules/mod_auth_basic.so
+</IfModule>
+<IfModule !mod_authn_file.c>
+	LoadModule authn_file_module modules/mod_authn_file.so
+</IfModule>
+<IfModule !mod_authz_user.c>
+	LoadModule authz_user_module modules/mod_authz_user.so
+</IfModule>
+</IfVersion>
 
 Alias /dumb/ www/
+Alias /auth/ www/auth/
 
 <Location /smart/>
 	SetEnv GIT_EXEC_PATH ${GIT_EXEC_PATH}

@@ -48,6 +70,13 @@ SSLMutex file:ssl_mutex
 SSLEngine On
 </IfDefine>
 
+<Location /auth/>
+	AuthType Basic
+	AuthName "git-auth"
+	AuthUserFile passwd
+	Require valid-user
+</Location>
+
 <IfDefine DAV>
 	LoadModule dav_module modules/mod_dav.so
 	LoadModule dav_fs_module modules/mod_dav_fs.so

diff --git a/t/lib-httpd/passwd b/t/lib-httpd/passwd
new file mode 100644
index 0000000..f2fbcad
--- /dev/null
+++ b/t/lib-httpd/passwd

@@ -0,0 +1 @@
+user@host:nKpa8pZUHx/ic

diff --git a/t/t5550-http-fetch.sh b/t/t5550-http-fetch.sh
index 2fb48d0..a0564de 100755
--- a/t/t5550-http-fetch.sh
+++ b/t/t5550-http-fetch.sh

@@ -34,6 +34,13 @@ test_expect_success 'clone http repository' '
 	test_cmp file clone/file
 '
 
+test_expect_failure 'clone http repository with authentication' '
+	mkdir "$HTTPD_DOCUMENT_ROOT_PATH/auth/" &&
+	cp -Rf "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" "$HTTPD_DOCUMENT_ROOT_PATH/auth/repo.git" &&
+	git clone $AUTH_HTTPD_URL/auth/repo.git clone-auth &&
+	test_cmp file clone-auth/file
+'
+
 test_expect_success 'fetch changes via http' '
 	echo content >>file &&
 	git commit -a -m two &&

-- 
1.7.2.3

Re: [PATCHv2 0/2] Fix username and password extraction from HTTP URLs

From: Tay Ray Chuan <hidden>
Date: 2016-06-15 22:50:02

On Sun, Nov 14, 2010 at 9:51 AM, Gabriel Corona
[off-list ref] wrote:

Percent-decode username and password in HTTP URLs. This is necessary
to specify a username with a '@' character in the URL.

Gabriel Corona (2):
 t5550: test HTTP authentication and userinfo decoding
 Fix username and password extraction from HTTP URLs

 http.c                  |   12 +++++++++++-
 t/lib-httpd.sh          |    3 +++
 t/lib-httpd/apache.conf |   29 +++++++++++++++++++++++++++++
 t/lib-httpd/passwd      |    1 +
 t/t5550-http-fetch.sh   |    7 +++++++
 5 files changed, 51 insertions(+), 1 deletions(-)
 create mode 100644 t/lib-httpd/passwd

Although the esotericity of having non-alphanumeric symbols in user
names escapes me, both look good.

  Acked-by: Tay Ray Chuan [off-list ref]

-- 
Cheers,
Ray Chuan

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help