inadyn icon indicating copy to clipboard operation
inadyn copied to clipboard

Basic Authentication fails when password contains \'

Open pro-sumer opened this issue 5 years ago • 3 comments

Not sure whether this is considered a user error or another instance of #211, but even when I use quotes (") around my password in the config file, Basic Authentication fails in inadyn 2.7 (on Asuswrt-Merlin) when the password contains \' (yes, my password manager actually generated this unlikely/troublesome combination), which will be converted to ' before encryption. Using \\' instead in the config file seems to work, but is confusing (so I changed my password to "fix" this).

While it may be a user error I submitted it anyway, since it took me quite some time to figure this out (comparing the output of -l debug with the output of a REST client (Paw) and then Base 64 decoding the two different Basic Authentication headers) and I hope we can prevent this for other users (even though the combination is not super likely).

pro-sumer avatar Jul 29 '20 09:07 pro-sumer

Thank you for your report. How do you propose we handle \ in passwords?

troglobit avatar Aug 02 '20 00:08 troglobit

For passwords I think it would best if all characters between the " quotes are treated as literals: used without any processing.

pro-sumer avatar Aug 02 '20 14:08 pro-sumer

Reasonable, noted. I'll look into it for the next release (possibly the next release of libConfuse, which we use for In-a-dyn). Thanks for getting back on this.

troglobit avatar Aug 02 '20 14:08 troglobit