Skip to content

digest: fix OWS and escaped quote handling - #20102

Closed
trxvorr wants to merge 3 commits into
curl:masterfrom
trxvorr:fix/digest-auth-ows-quotes
Closed

digest: fix OWS and escaped quote handling#20102
trxvorr wants to merge 3 commits into
curl:masterfrom
trxvorr:fix/digest-auth-ows-quotes

Conversation

@trxvorr

@trxvorr trxvorr commented Dec 27, 2025

Copy link
Copy Markdown
Contributor

The migration to the strparse API introduced regressions in Digest authentication parsing where Optional Whitespace (OWS) after commas was not skipped, and escaped quotes in values were not correctly parsed.

This change ensures whitespace is skipped before key lookups and escaped characters are properly handled and unescaped in quoted values.

Reported-by: herdiyanitdev (hackerone)

@github-actions github-actions Bot added the tests label Dec 27, 2025
@trxvorr

trxvorr commented Dec 27, 2025

Copy link
Copy Markdown
Contributor Author

this was the report
https://hackerone.com/reports/3473384

@testclutch

Copy link
Copy Markdown

Analysis of PR #20102 at e3c3ac15:

Test 1664 failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 810 different CI jobs (the link just goes to one of them).

Test 2084 failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 296 different CI jobs (the link just goes to one of them). Note that this CI job has had a number of other flaky tests recently (3, to be exact) so it may be that this failure is rather a systemic issue with this job and not with this specific PR.

Test 2500 failed, but it has been 20.1% flaky lately, so it's probably NOT a fault of the PR. Note that this test has failed in 4 different CI jobs (the link just goes to one of them). Note that this CI job has had a number of other flaky tests recently (3, to be exact) so it may be that this failure is rather a systemic issue with this job and not with this specific PR.

Generated by Testclutch

@trxvorr
trxvorr marked this pull request as draft December 28, 2025 04:30
@trxvorr
trxvorr force-pushed the fix/digest-auth-ows-quotes branch 5 times, most recently from 7d3037e to 1584df8 Compare December 28, 2025 09:34
Comment thread tests/data/test2084 Outdated
Comment thread tests/data/test2091 Outdated
@trxvorr
trxvorr force-pushed the fix/digest-auth-ows-quotes branch from 1584df8 to 008a74c Compare December 28, 2025 10:10
Comment thread tests/data/test2084
@trxvorr
trxvorr force-pushed the fix/digest-auth-ows-quotes branch 2 times, most recently from 279f91c to f448445 Compare December 28, 2025 17:23
The migration to the strparse API introduced regressions in Digest
authentication parsing where Optional Whitespace (OWS) after commas
was not skipped, and escaped quotes in values were not correctly
parsed.

This change ensures whitespace is skipped before key lookups and
escaped characters are properly handled and unescaped in quoted
values.

Reported-by: herdiyanitdev (hackerone)
@trxvorr
trxvorr force-pushed the fix/digest-auth-ows-quotes branch from 1aaff18 to 497c7b5 Compare December 28, 2025 18:28
@trxvorr
trxvorr marked this pull request as ready for review December 28, 2025 18:34
@trxvorr

trxvorr commented Dec 28, 2025

Copy link
Copy Markdown
Contributor Author

@vszakats i think everything is working as intended now could you please check?

@trxvorr

trxvorr commented Dec 29, 2025

Copy link
Copy Markdown
Contributor Author

@vszakats hey hope you're doing well
any updates?

Comment thread lib/curlx/strparse.c
@trxvorr
trxvorr force-pushed the fix/digest-auth-ows-quotes branch from b2450cf to f2bcab8 Compare December 30, 2025 16:26
@bagder bagder closed this in f81e719 Dec 30, 2025
@bagder

bagder commented Dec 30, 2025

Copy link
Copy Markdown
Member

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Development

Successfully merging this pull request may close these issues.

5 participants