Skip to content

libcurl: unexpected url-decoding for CURLOPT_PROXYPASSWORD & CURLOPT_PROXYUSERNAME values #13265

Closed
@tilicho

Description

@tilicho

I did this

#include <curl/curl.h>

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode res;
    curl_easy_setopt(curl, CURLOPT_URL, "http://curl.se");
    curl_easy_setopt(curl, CURLOPT_PROXY, "http://curl.se:80");
    curl_easy_setopt(curl, CURLOPT_PROXYUSERNAME, "mrsmith%aaa");
    curl_easy_setopt(curl, CURLOPT_PROXYPASSWORD, "qwerty%4b!");
    curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
    res = curl_easy_perform(curl);
    curl_easy_cleanup(curl);
  }
  return 0;
}

I expected the following

Proxy should get username "mrsmith%aaa" and password "qwerty%4b!".

But proxy gets this:

* Proxy auth using Basic with user 'mrsmitha'
> GET http://curl.se/ HTTP/1.1
Host: curl.se
Proxy-Authorization: Basic bXJzbWl0aKphOnF3ZXJ0eUsh
Accept: */*
Proxy-Connection: Keep-Alive

After base64 decoding auth string "bXJzbWl0aKphOnF3ZXJ0eUsh" is "mrsmitha:qwertyK!".
But auth string should be "mrsmith%aaa:qwerty%4b!".

According documentation, CURLOPT_PROXYUSERNAME and CURLOPT_PROXYPASSWORD values are not supposed to be url-encoded.
Only CURLOPT_PROXYUSERPWD value is supposed to be url-encoded.

curl/libcurl version

8.7.0 and earlier

operating system

all

Activity

self-assigned this
on Apr 2, 2024
added a commit that references this issue on Apr 3, 2024
00febea
added a commit that references this issue on Apr 4, 2024
d5e83eb
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

    Development

    Participants

    @bagder@tilicho

    Issue actions

      libcurl: unexpected url-decoding for CURLOPT_PROXYPASSWORD & CURLOPT_PROXYUSERNAME values · Issue #13265 · curl/curl