Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Curl does not parse correctly the "qop=" parameter of Digest authentication #9264

Closed
vlubart opened this issue Aug 7, 2022 · 2 comments
Closed

Curl does not parse correctly the "qop=" parameter of Digest authentication #9264

vlubart opened this issue Aug 7, 2022 · 2 comments
Assignees
@bagder
Labels
authentication

Comments

@vlubart
Copy link

vlubart commented Aug 7, 2022

When parsing the "qop=" parameter of the digest authentication Curl uses “,” delimiter. See function auth_digest_get_qop_values() in

curl/lib/vauth/digest.c

Line 235 in 40b6206

token = strtok_r(tmp, ",", &tok_buf);
:
token = strtok_r(tmp, ",", &tok_buf);
The same at

curl/lib/vauth/digest.c

Line 244 in 40b6206

token = strtok_r(NULL, ",", &tok_buf);
.

According to RFC https://www.ietf.org/rfc/rfc7616.html the qop delimiter can actually include a whitespace , as in the example that appears in the RFC :
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Digest
realm="http-auth@example.org",
qop="auth, auth-int",
(comma-whitespace instead of just comma)

In this case Curl would wrongly parse a token " auth-int" (with leading whitespace) instead of just "auth-int".
Found on Ubuntu 21.04
bagder added a commit that referenced this issue Aug 7, 2022
@bagder
digest: pass over leading spaces in qop values
657ad6e 
When parsing the "qop=" parameter of the digest authentication, and the
value is provided within quotes, the list of values can have leading
white space which the parser previously did not handle correctly.

Add test case 388 to verify.

Reported-by: vlubart on github
Fixes #9264
Closes #
@bagder bagder mentioned this issue Aug 7, 2022
Closed
@bagder bagder self-assigned this Aug 7, 2022
@bagder bagder closed this as completed in 0ad7c8d Aug 8, 2022
@vlubart
Copy link
Author

vlubart commented Aug 8, 2022

Thanks for the quick resolution! When a release with this fix can be expected ?

@bagder
Copy link
Member

bagder commented Aug 8, 2022 •
edited

This fix will be included in the next release. 7.85.0 is expected to ship on August 31.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bagder bagder

Labels
authentication
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

digest: pass over leading spaces in qop values curl/curl
2 participants
@bagder @vlubart