Issue #2520: credentials in feed URL are not url-unquoted - Pulp

Actions

Send by e-mail Copy link

Issue #2520

closed

credentials in feed URL are not url-unquoted

Added by mhrivnak almost 8 years ago. Updated over 5 years ago.

Status:

CLOSED - CURRENTRELEASE

Priority:

Normal

Assignee:

daviddavis

Category:

Sprint/Milestone:

Start date:

Due date:

Estimated time:

Severity:

2. Medium

Version:

Platform Release:

2.11.2

OS:

Triaged:

Yes

Groomed:

Sprint Candidate:

Tags:

Easy Fix, Pulp 2

Sprint:

Sprint 13

Quarter:

Description

This change: https://github.com/pulp/pulp/pull/2697/files#diff-ea2980a00ce94a68c6280c62d0e8b64eR57

introduced the ability to automatically parse a feed url, extract any credentials included in the URL, and add them to an importer config.

It fails to "urlunquote" the credentials, so if a user includes a url-quotable character in a credential, authentication will fail.

For example, "username:p@ssword" would appear in the URL as "username:p%40ssword". The credentials need to be passed through this function before being added to the importer config:

https://docs.python.org/2/library/urllib.html#urllib.unquote

Related issues

Actions

Copy link

Updated by mhrivnak almost 8 years ago

Related to Issue #1977: basic auth in URL fails when using authenticated proxy added

Actions

Copy link

Updated by bizhang almost 8 years ago

Sprint/Milestone set to 31
Triaged changed from No to Yes

Actions

Copy link

Updated by daviddavis almost 8 years ago

Status changed from NEW to ASSIGNED
Assignee set to daviddavis

Actions

Copy link

Updated by daviddavis almost 8 years ago

What if the user's password in the URL is actually p%40ssword and not p@ssword? For example, before this change:

pulp-admin rpm repo create --repo-id test --feed "http://usern%40me:password@example.com/repo"
pulp-admin rpm repo list --repo-id test --details
...
Basic Auth Username: usern%40me

After this change:

pulp-admin rpm repo create --repo-id test --feed "http://usern%40me:password@example.com/repo"
pulp-admin rpm repo list --repo-id test --details
...
Basic Auth Username: usern@me

Two possible solutions:

1. Mandate that users pass in feed as a url quoted string (in this case usern%2540me)
2. Have pulp-admin convert any feed url passed in to its url quoted equivalent and send it to the server

Actions

Copy link

Updated by mhrivnak almost 8 years ago

I like the edge-case scrutiny. :)

I like solution 1. We should require the user to construct correct URLs. If they put a string in the URL that conflicts with standard URL quoting, that's just incorrect.

Actions

Copy link