stompgem / stomp

A ruby gem for sending and receiving messages from a Stomp protocol compliant message queue. Includes: failover logic, ssl support.
http://stomp.github.com
Apache License 2.0
152 stars 80 forks source link

URL regex matching should allow for non-word characters in passwords and usernames #65

Closed PaulGale closed 11 years ago

PaulGale commented 11 years ago

In client/utils.rb the method:

def url_regex
  '(([\w\.\-]*):(\w*)@)?([\w\.\-]+):(\d+)'
end

should be changed to:

def url_regex
  '(([\w~!@#$%^&*()\-+=.?:<>,.]*\w):([\w~!@#$%^&*()\-+=.?:<>,.]*)@)?([\w\.\-]+):(\d+)'
end

This will match the following URLs:

host1.com:61613
@host1.com:61613
f@#$$%^&*()_+=o.o:@host1.com:61613
f@#$$%^&*()_+=o.o::b~!@#$%^&*()+-_=?:<>,.@@host1.com:61613

with the restriction that the username must end on a word character \w, which is a minor concession.

The extracted username and password are:

f@#$$%^&*()_+=o.o

and:

:b~!@#$%^&*()+-_=?:<>,.@

respectively.

gmallard commented 11 years ago

This idea is nice, particularly regarding passwords.

With that regex in place, try this with an appropriate hostname:

require 'rubygems'
require 'stomp'
hostname = "tjjackson"
td = [ "stomp://guestl:guestp@#{hostname}:61613", # 0, PASS
      "stomp://#{hostname}:61613", # 1, PASS
      # This gives incorrect login and host (defaults as localhost)
      "stomp://@#{hostname}:61613", # 2, FAIL
      "stomp://f@#$$%^&*()_+=o.o:@#{hostname}:61613", # 3, PASS
      'stomp://f@#$$%^&*()_+=o.o::b~!@#$%^&*()+-_=?:<>,.@@' + hostname + ":61613", # 4, PASS
]
td.each_with_index do |url, ndx|
  c = Stomp::Client.new(url)
  puts "#{ndx} connected: #{c.open?}"
  #
  puts "login: #{c.instance_eval('@login')}"
  puts "passcode: #{c.instance_eval('@passcode')}"
  puts "host: #{c.instance_eval('@host')}"
  puts "port: #{c.instance_eval('@port')}"
  #
  c.close
  puts "=" * 65
end
gmallard commented 11 years ago

All tests above pass with a slightly different regex and changed match offsets. Those changes in the commit referenced above.

Closing.