Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

URL regex matching should allow for non-word characters in passwords and usernames #65

Closed
PaulGale opened this issue Jul 31, 2013 · 2 comments

Comments

@PaulGale
Copy link

In client/utils.rb the method:

def url_regex
  '(([\w\.\-]*):(\w*)@)?([\w\.\-]+):(\d+)'
end

should be changed to:

def url_regex
  '(([\w~!@#$%^&*()\-+=.?:<>,.]*\w):([\w~!@#$%^&*()\-+=.?:<>,.]*)@)?([\w\.\-]+):(\d+)'
end

This will match the following URLs:

host1.com:61613
@host1.com:61613
f@#$$%^&*()_+=o.o:@host1.com:61613
f@#$$%^&*()_+=o.o::b~!@#$%^&*()+-_=?:<>,.@@host1.com:61613

with the restriction that the username must end on a word character \w, which is a minor concession.

The extracted username and password are:

f@#$$%^&*()_+=o.o

and:

:b~!@#$%^&*()+-_=?:<>,.@

respectively.

@gmallard
Copy link

This idea is nice, particularly regarding passwords.

With that regex in place, try this with an appropriate hostname:

require 'rubygems'
require 'stomp'
hostname = "tjjackson"
td = [ "stomp://guestl:guestp@#{hostname}:61613", # 0, PASS
      "stomp://#{hostname}:61613", # 1, PASS
      # This gives incorrect login and host (defaults as localhost)
      "stomp://@#{hostname}:61613", # 2, FAIL
      "stomp://f@#$$%^&*()_+=o.o:@#{hostname}:61613", # 3, PASS
      'stomp://f@#$$%^&*()_+=o.o::b~!@#$%^&*()+-_=?:<>,.@@' + hostname + ":61613", # 4, PASS
]
td.each_with_index do |url, ndx|
  c = Stomp::Client.new(url)
  puts "#{ndx} connected: #{c.open?}"
  #
  puts "login: #{c.instance_eval('@login')}"
  puts "passcode: #{c.instance_eval('@passcode')}"
  puts "host: #{c.instance_eval('@host')}"
  puts "port: #{c.instance_eval('@port')}"
  #
  c.close
  puts "=" * 65
end

@gmallard
Copy link

All tests above pass with a slightly different regex and changed match offsets. Those changes in the commit referenced above.

Closing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants