Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Setting CURLOPT_NETRC breaks basic auth credential quoting in curl 7.85 (7.84?) #9709

Closed
jonashaag opened this issue Oct 12, 2022 · 1 comment
Closed

Setting CURLOPT_NETRC breaks basic auth credential quoting in curl 7.85 (7.84?) #9709

jonashaag opened this issue Oct 12, 2022 · 1 comment
Assignees
@bagder
Labels
authentication regression

Comments

@jonashaag
Copy link

xref mamba-org/mamba#2010

In Mamba we set CURLOPT_NETRC: https://github.com/mamba-org/mamba/blob/f7a001e24df59ec8e35b45b2e404cd8b049c8eb9/libmamba/src/core/fetch.cpp#L230-L231

In one of 7.85 or 7.84 this interacts with basic auth credentials quoting so that credentails given in an URL like

user%40host.com:secret

will be sent as user%40host in the Authorization header. In curl 7.83 they were sent as user@host.

If I remove the line that sets CURLOPT_NETRC then it works fine as well, so there seems to be an interaction between netrc and quoted credentials that has changed in either 7.84 or 7.85. Maybe one of #9243 or #8908?

I didn't test 7.84, only 7.83 and 7.85, because 7.84 is not available on conda-forge.

Unfortunately I'm unable to reproduce this outside of Mamba. I tried a C API example and pycurl but in both cases quoting is correct.

operating system

Can reproduce on Linux and macOS.
@jonashaag
Copy link
Author

jonashaag commented Oct 12, 2022 •
edited

Actually I can reproduce this, I was just using the wrong version of libcurl. Example

#include <stdio.h>
#include <curl/curl.h>

int main(void)
{
  printf("%s\n", curl_version());
  CURL *curl;
  CURLcode res;
  curl_global_init(CURL_GLOBAL_DEFAULT);
  curl = curl_easy_init();
  if(curl) {
    curl_easy_setopt(curl, CURLOPT_URL, "http://foo%40bar:secret@localhost:8000/");
    curl_easy_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
    res = curl_easy_perform(curl);
    if(res != CURLE_OK)
      fprintf(stderr, "curl_easy_perform() failed: %s\n",
              curl_easy_strerror(res));
    curl_easy_cleanup(curl);
  }
  curl_global_cleanup();
  return 0;
}

Compare the Authorization header with libcurl 7.83 and libcurl 7.85.

@bagder bagder self-assigned this Oct 12, 2022
bagder added a commit that referenced this issue Oct 12, 2022
@bagder
netrc: use URL decoded user and avoid setting if not changed
e9bb1ba 
Reported-by: Jonas Haag
Fixes #9709
Closes #....
@bagder bagder mentioned this issue Oct 12, 2022
Closed
bagder added a commit that referenced this issue Oct 13, 2022
@bagder
netrc: use URL decoded user and avoid setting if not changed
15a4665 
Reported-by: Jonas Haag
Fixes #9709
Closes #....
bagder added a commit that referenced this issue Oct 13, 2022
@bagder
test495: verify URL encoded user name + netrc-optional
796dd28 
Reproduced issue #9709
@bagder bagder closed this as completed in a2aa980 Oct 13, 2022
bagder added a commit that referenced this issue Oct 13, 2022
@bagder
test495: verify URL encoded user name + netrc-optional
c4715b1 
Reproduced issue #9709
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bagder bagder

Labels
authentication regression
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

netrc: use URL decoded user curl/curl
2 participants
@jonashaag @bagder