Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent encoding of [] in the host part of IPv6 reference URIs #8390

Open
wants to merge 8 commits into
base: main
Choose a base branch
from

Conversation

FelixMartel
Copy link

@FelixMartel FelixMartel commented Mar 7, 2024

Currently proxying IPv6 reference URIs is not possible #3705. This is because HttpRequestHeader.parseURI first attempts to repair URIs containing unencoded characters by encoding them before calling new URI with encoded=true. Otherwise new URI would throw a URIException. This includes the [] characters that are part of the IPv6 reference section and so new URI(http://[::1]/) becomes new URI(http://%5B::1%5C).

Here I want to avoid having to add parsing of the authority section to HttpRequestHeader while keeping the URI repairing behavior the same. Only calling new URI with encoded=false gives a different result (for example % becomes %25) and so it is only used to detect IPv6 reference URIs and parse out the host:

  • First call new URI with encoded=false.
  • If this was an IPv6 reference then apply repairing to the rest of URI.
  • Otherwise repair the whole URI.
  • Finally call new URI with encoded=true.

Copy link

github-actions bot commented Mar 7, 2024

CLA Assistant Lite bot All contributors have signed the CLA ✍️ ✅

@thc202
Copy link
Member

thc202 commented Mar 8, 2024

Better accept the CLA before continuing with more work, without that the changes will not be merged.

@thc202
Copy link
Member

thc202 commented Mar 8, 2024

This will require tests (a lot of them).

@FelixMartel
Copy link
Author

I have read the CLA Document and I hereby sign the CLA

@FelixMartel

This comment has been minimized.

zapbot added a commit to zaproxy/cla that referenced this pull request Mar 8, 2024
}

private static Stream<Arguments> ipv6referenceUrlHostPairs() {
List<Arguments> urls = new ArrayList<>();
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could use List.of

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Or even Stream.of I think, should be other examples in the repo

@kingthorin
Copy link
Member

Seems to have broken binary compatability

@kingthorin
Copy link
Member

kingthorin commented Mar 9, 2024

Does <username>:<password>@<host> parse as expected if password has square brackets?

@FelixMartel
Copy link
Author

FelixMartel commented Mar 9, 2024

Looks like it behaves the same as it does now when given asdf:[]@example.com. In practice I don't think clients supply credentials there.

@kingthorin
Copy link
Member

They "shouldn't", but it's 'allowed' by spec and browsers so it'd be good to add a test just to ensure that nothing breaks in the future, for my two cents.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

None yet

3 participants