You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Jul 13, 2021. It is now read-only.
While not optimal from a security perspective, it is moderately common for http clients to send URLs that contain usernames and passwords such as http://name:[email protected]/somepath/. Polipo parses these URLs assuming that the colon is always a separator between host and port as in http://example.com:8080/somepath. Depending on the content of the request, this can result is several different errors, a hostname lookup error using the password as a hostname, a forbidden port error (if the password begins with a number), probably other conditions are possible. It would be good if polipo was able to parse URLs containing usernames and passwords in them.
The text was updated successfully, but these errors were encountered:
mlococo
changed the title
Password in URL parsed as port
Support usernames and passwords in URLs
Jan 20, 2016
While not optimal from a security perspective, it is moderately common for http clients to send URLs that contain usernames and passwords such as
http://name:[email protected]/somepath/
. Polipo parses these URLs assuming that the colon is always a separator between host and port as inhttp://example.com:8080/somepath
. Depending on the content of the request, this can result is several different errors, a hostname lookup error using the password as a hostname, a forbidden port error (if the password begins with a number), probably other conditions are possible. It would be good if polipo was able to parse URLs containing usernames and passwords in them.The text was updated successfully, but these errors were encountered: