Commitff259a6

authored and

committed

Ensure passwords in hosted Git URLs are correctly escaped

PR-URL:#58Credit:@stevenhilderClose:#58Reviewed-by:@darcyclarke

1 parent624fd6f commitff259a6Copy full SHA for ff259a6

File tree

+28

-2

lines changed

+28

-2

lines changed

Lines changed: 10 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,7 @@ function fromUrl (giturl, opts) {`
`47`	`47`	`vargitHostInfo=gitHosts[gitHostName]`
`48`	`48`	`varauth=null`
`49`	`49`	`if(parsed.auth&&authProtocols[parsed.protocol]){`
`50`		`-auth=decodeURIComponent(parsed.auth)`
	`50`	`+auth=parsed.auth`
`51`	`51`	`}`
`52`	`52`	`varcommittish=parsed.hash ?decodeURIComponent(parsed.hash.substr(1)) :null`
`53`	`53`	`varuser=null`
`@@ -106,7 +106,15 @@ function fixupUnqualifiedGist (giturl) {`
`106`	`106`
`107`	`107`	`functionparseGitUrl(giturl){`
`108`	`108`	`varmatched=giturl.match(/^([^@]+)@([^:/]+):[/]?((?:[^/]+[/])?[^/]+?)(?:[.]git)?(#.*)?$/)`
`109`		`-if(!matched)returnurl.parse(giturl)`
	`109`	`+if(!matched){`
	`110`	`+varlegacy=url.parse(giturl)`
	`111`	`+if(legacy.auth){`
	`112`	`+varwhatwg=newurl.URL(giturl)`
	`113`	`+legacy.auth=whatwg.username\|\|''`
	`114`	`+if(whatwg.password)legacy.auth+=':'+whatwg.password`
	`115`	`+}`
	`116`	`+returnlegacy`
	`117`	`+}`
`110`	`118`	`return{`
`111`	`119`	`protocol:'git+ssh:',`
`112`	`120`	`slashes:true,`

Lines changed: 18 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,18 @@`
	`1`	`+varHostedGitInfo=require('../')`
	`2`	`+`
	`3`	`+vartap=require('tap')`
	`4`	`+varurl=require('url')`
	`5`	`+`
	`6`	`+// Auth credentials with special characters (colon and/or at-sign) should remain correctly escaped`
	`7`	`+varparsedInfo=HostedGitInfo.fromUrl('https://user%3An%40me:p%40ss%3Aword@github.com/npm/hosted-git-info.git')`
	`8`	`+tap.equal(parsedInfo.auth,'user%3An%40me:p%40ss%3Aword')`
	`9`	`+`
	`10`	+// Node.js' built-in `url` module should be able to parse the resulting url
	`11`	`+varparsedUrl=newurl.URL(parsedInfo.toString())`
	`12`	`+tap.equal(parsedUrl.username,'user%3An%40me')`
	`13`	`+tap.equal(parsedUrl.password,'p%40ss%3Aword')`
	`14`	`+tap.equal(parsedUrl.hostname,'github.com')`
	`15`	`+`
	`16`	`+// For full backwards-compatibility; support auth where only username or only password is provided`
	`17`	`+tap.equal(HostedGitInfo.fromUrl('https://user%3An%40me@github.com/npm/hosted-git-info.git').auth,'user%3An%40me')`
	`18`	`+tap.equal(HostedGitInfo.fromUrl('https://:p%40ss%3Aword@github.com/npm/hosted-git-info.git').auth,':p%40ss%3Aword')`

Comments

(0)