Uploaded image for project: 'TomEE'
  1. TomEE
  2. TOMEE-2656

HTTP(s) basic auth failed if password contained ampersand passed via basic.password URL parameter

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 7.0.6, 7.1.1, 8.0.0-M3
    • 8.0.0-Final
    • TomEE Core Server
    • None

    Description

      Adding this issue to add an issue number to the PR proposed on Github: https://github.com/apache/tomee/pull/104

      A double-decode bug caused URLDecode to be applied twice to parameters passed in
      via URL including basic.username and basic.password. The parameters were automatically
      decoded by the call to URI.getQuery() then again as each parameter was parsed and added
      to the returned Map in MulticastConnectionFactory.URIs.parseQuery(). parseQuery() splits the
      query string on the ampersand character then explictly URLDecode's each value. Since
      URI.getQuery() had already decoded the basic.password parameter, the splitting process
      in parseQuery truncated the password at the first ampersand character.

      Instead, URI.getRawQuery() should be called to get the still URLEncoded query string. The
      splitting and subsequent decoding in parseQuery() then correctly extracts the full password
      from the query string.

      PR contains failing unit test & fix.

       

      Attachments

        Activity

          People

            Unassigned Unassigned
            rzo1 Richard Zowalla
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: