search

pdmangel / node-red-contrib-openhab2

Other
21 stars 15 forks source link

Password is injected into URL, nothing escaped #41

Open rubdos opened 4 years ago

rubdos commented 4 years ago

When using a password with characters such as : and @, weird errors are thrown (not finding hostname username), completely unrelated to the issue: the password contains characters that are not escaped in https://github.com/pdmangel/node-red-contrib-openhab2/blob/master/77-openhab2.js#L23

I'm very inexperienced with NodeJS, but I assume it has some functionality to do a proper basic auth, instead of hijacking the URL?

pdmangel commented 4 years ago

As a quick fix, version 1.1.7 of node-red-contrib-openhab2 now escapes special characters in username and password properly. Please feedback your test result in this thread.