[GitHub] [couchdb] nickva edited a comment on pull request #3546: Fix bug in Replicator authentication for password contains @

[GitBox <gi...@apache.org>]

nickva edited a comment on pull request #3546:
URL: https://github.com/apache/couchdb/pull/3546#issuecomment-841862668


   I think there may be a few incompatibility issues here and we should fix it up a bit better.
   
   One issue is unquoting the '+' symbol into a space ' '. Technically the '+' is a valid character in userinfo part. This means a password which had a '+' in it, like say "a+b" used to work just fine now will fail because we'd decode into "a b". This probably means we'd have to make our own unquoting logic and excluding the '+' sign from it at least.
   
   Another issue is passwords which had '%HH` sequence where 'H' is any hex digit would also be decoded into something which will not match the original password. Not sure how serious one one would be. Maybe we document it and ask users to double-check their replications after the upgrade. Or perhaps have config option to let uses opt out of using decoding for the userinfo part like we did in previous issues too.
   
   
   This was prompted by the @flimzy's findings in the related issue https://github.com/apache/couchdb/issues/3565


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org