search

noodlefrenzy / node-amqp10

amqp10 is a promise-based, AMQP 1.0 compliant node.js client
MIT License
134 stars 56 forks source link

Default policy doesn't copy with username/password's that contain a colon (:) #318

Closed dnwe closed 7 years ago

dnwe commented 7 years ago

The default policy truncates passwords at the first colon (':') character that they contain. Obviously this means that you can't use passwords that contain this character to successfully connect to a remote server.

This is due to the way that lib/policies/policy.js parses a the value from a urlObject.auth field. Specifically:

    var userPass = parsedAddress.auth.split(':', 2);
    result.user = userPass[0];
    result.pass = userPass[1] || null;

Because urlObject.auth is always a URI decoded value - if either the username or password portion of the authentication information contain a colon character it is ambiguous as to where the two fields are delimited.