In our current implementation, the macros interpreter does not adequately protect JSON passwords that contain double quotes (") and backslashes (\). This issue can lead to connection issues due to malformed requests.
Here is an example of an HTTP body which can lead to the problem described above:
When %{PASSWORD} is replaced with the configured password that contains double quotes or backslashes, the interpretation will result in malformed JSON or improperly escaped characters.
Suggested solution
To address this issue, we suggest to introduce two macros, %{USERNAME_JSON} and %{PASSWORD_JSON}, that will ensure the proper escaping of special characters (double quotes and backslashes) in the password and username values during macro interpretation. The macros in the above example will look like this:
The Macro interpreter should be enhanced to escape double quotes and backslashes in the password and username values when replacing the %{PASSWORD_JSON} and %{USERNAME_JSON} macros with the actual password and username.
Description
In our current implementation, the macros interpreter does not adequately protect JSON passwords that contain double quotes (") and backslashes (\). This issue can lead to connection issues due to malformed requests.
Here is an example of an HTTP body which can lead to the problem described above:
When
%{PASSWORD}is replaced with the configured password that contains double quotes or backslashes, the interpretation will result in malformed JSON or improperly escaped characters.Suggested solution
To address this issue, we suggest to introduce two macros,
%{USERNAME_JSON}and%{PASSWORD_JSON}, that will ensure the proper escaping of special characters (double quotes and backslashes) in the password and username values during macro interpretation. The macros in the above example will look like this:The Macro interpreter should be enhanced to escape double quotes and backslashes in the password and username values when replacing the
%{PASSWORD_JSON}and%{USERNAME_JSON}macros with the actual password and username.Implementation Steps (Java class: HttpMacrosUpdater)
%{PASSWORD_JSON}and%{USERNAME_JSON}macros with the correctly escaped password and username value from the configuration.") and backslashes (\) in the password and username values.my"pa\ssword, the interpreter should replace%{PASSWORD_JSON}withmy\"pa\\ssword.sentry\marc, the interpreter should replace%{USERNAME_JSON}withsentry\\marc.