search

launchdarkly / ld-relay

LaunchDarkly Relay Proxy
Other
112 stars 80 forks source link

The Launch Darkly Relay Proxy cannot handle punctuation in the Redis Password #166

Closed chrisjgray closed 2 years ago

chrisjgray commented 2 years ago

Is this a support request? This issue tracker is maintained by LaunchDarkly SDK developers and is intended for feedback on the SDK code. If you're not sure whether the problem you are having is specifically related to the SDK, or to the LaunchDarkly service overall, it may be more appropriate to contact the LaunchDarkly support team; they can help to investigate the problem and will consult the SDK team if necessary. You can submit a support request by going here or by emailing support@launchdarkly.com.

Note that issues filed on this issue tracker are publicly accessible. Do not provide any private account information on your issues. If your problem is specific to your account, you should submit a support request as described above.

Describe the bug When having symbols in the password via the REDIS_URL, which currently is the only way to pass both username and password, the relay would error out.

To reproduce pass REDIS_URL with rediss://username:pa><ssword@somehost.com:6389

Expected behavior As Redis will accept passwords with punctuation when using tools like redis-cli, the relay should also handle the same.

Logs ERROR: Configuration error: REDIS_URL: not a valid URL/URI

SDK version This was using the latest version of the docker image.

Language version, developer tools For instance, Go 1.11 or Ruby 2.5.3. If you are using a language that requires a separate compiler, such as C, please include the name and version of the compiler too.

OS/platform For instance, Ubuntu 16.04, Windows 10, or Android 4.0.3. If your code is running in a browser, please also include the browser type and version.

Additional context Add any other context about the problem here.

eli-darkly commented 2 years ago

The message "not a valid URL/URI" is correct: you can't have the literal characters > or < in the username/password fields of a URL, not just a Redis URL but any URL. The solution is simply to URL-encode those, as you would do for any disallowed punctuation in a URL.

We can consider adding a specific username field in the configuration, but I wanted to clarify that the string in your example would not work in any Redis application that uses a URL for configuration (at least, not if they put it through any kind of spec-compliant URL validation). That's a different issue from Redis accepting the password without escaping when you pass it as a completely separate option.

eli-darkly commented 2 years ago

Since https://github.com/launchdarkly/ld-relay/issues/167 is already open as a separate issue for adding a username field, I'm going to close this one.