search

troglobit / inadyn

In-a-Dyn is a dynamic DNS client with multiple SSL/TLS library support
https://troglobit.com/projects/inadyn/
GNU General Public License v2.0
979 stars 142 forks source link

Basic Authentication fails when password contains \' #317

Open pro-sumer opened 4 years ago

pro-sumer commented 4 years ago

Not sure whether this is considered a user error or another instance of #211, but even when I use quotes (") around my password in the config file, Basic Authentication fails in inadyn 2.7 (on Asuswrt-Merlin) when the password contains \' (yes, my password manager actually generated this unlikely/troublesome combination), which will be converted to ' before encryption. Using \\' instead in the config file seems to work, but is confusing (so I changed my password to "fix" this).

While it may be a user error I submitted it anyway, since it took me quite some time to figure this out (comparing the output of -l debug with the output of a REST client (Paw) and then Base 64 decoding the two different Basic Authentication headers) and I hope we can prevent this for other users (even though the combination is not super likely).

troglobit commented 4 years ago

Thank you for your report. How do you propose we handle \ in passwords?

pro-sumer commented 4 years ago

For passwords I think it would best if all characters between the " quotes are treated as literals: used without any processing.

troglobit commented 4 years ago

Reasonable, noted. I'll look into it for the next release (possibly the next release of libConfuse, which we use for In-a-dyn). Thanks for getting back on this.