Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

XrdCl::URL accepts invalid URL and rejects valid ones as invalid #1960

Open
amadio opened this issue Mar 14, 2023 · 2 comments
Open

XrdCl::URL accepts invalid URL and rejects valid ones as invalid #1960

amadio opened this issue Mar 14, 2023 · 2 comments
Assignees

Comments

@amadio
Copy link
Member

amadio commented Mar 14, 2023

While converting the XrdCl::URL tests to GoogleTest, I noticed that it accepts zero, negative, and big (>65536) port numbers as valid. For example, "root://eospilot.cern.ch:-1", and "root://eospilot.cern.ch:281474976710656" are both considered valid. I also noticed that a URL with parameters, but without a path will be considered invalid, i.e. something like http://localhost:8080?param=value. However, that should likely be considered valid, with path normalized to "/", as that's what the browser does. URLs with empty username and/or password are also rejected, i.e., something like http://:@localhost and http://@localhost. Should these be considered valid? The browser seems to accept them. The final thing is that XrdCl::URL cannot accept passwords that contain the character @ or / in them, but I guess that's not really a bug, even if those are supposedly valid characters for passwords.

@bbockelm
Copy link
Contributor

Per https://www.rfc-editor.org/rfc/rfc1738, it appears that the password should be escaped in order to allow reserved symbols like @.

Note the interesting semantics to differentiate between “no user or password is set” and “user and password are set to an empty string”.

@amadio
Copy link
Member Author

amadio commented Mar 14, 2023

Thanks for the link to the RFC. I think we should try to follow it as closely as possible.

@amadio amadio self-assigned this Jul 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants