net/url: url.Parse() does not allow `/` in http basic auth password

[jhoblitt]

Go version

go version go1.23.4 linux/amd64

Output of go env in your module/workspace:

GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/jhoblitt/.cache/go-build'
GOENV='/home/jhoblitt/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/jhoblitt/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/jhoblitt/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org'
GOROOT='/home/jhoblitt/sdk/go1.23.4'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/home/jhoblitt/sdk/go1.23.4/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.4'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/jhoblitt/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/home/jhoblitt/github/rook/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build701679148=/tmp/go-build -gno-record-gcc-switches'

What did you do?

rfc2617 specifies that the password when using http basic auth is base64 encoded: https://datatracker.ietf.org/doc/html/rfc2617#page-5. base64 may use /: https://datatracker.ietf.org/doc/html/rfc2045#page-25

This example fails with parse "kafka://foo:b/ar@hostname.org:9094": invalid port ":b" after host:

import (
	"fmt"
	"net/url"
)

func main() {
	parsedURI, err := url.Parse("kafka://foo:b/ar@hostname.org:9094")
	if err != nil {
		fmt.Println(err)
	}
	fmt.Println(parsedURI)
}

https://go.dev/play/p/aodJzgziUVo

What did you see happen?

Part of the base64 password was treated as the port number.

What did you expect to see?

The example url "kafka://foo:b/ar@hostname.org:9094" is successfully parsed.

[seankhliao]

It is base64 in a http header, not in the userinfo url.
URL parsing is RFC 2396.

Unlike many projects, the Go project does not use GitHub Issues for general discussion or asking questions. GitHub Issues are used for tracking bugs and proposals only.

For questions please refer to https://github.com/golang/go/wiki/Questions

[gabyhelp]

Related Issues

• net/url: func parse(rawURL string, viaRequest bool) (*URL, error) #63280 (closed)
• net/url: do not URL-escape auth info before base64 encoding #5970 (closed)
• net/http: http.NewRequest is error parse ... invalid URL escape "%%" #64866 (closed)
• net/url: can't roundtrip path-only url with double leading slash #44631
• net/url: Parse does not permit percent escapes in host #30844 (closed)
• net/url: Parse thinks /// does not start an authority #46277
• net/url: URL.String() does not escape Query #30922

Related Code Changes

• net/url: fixed host :port parsing

Related Discussions

• Possible bug with url.Parse?

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[jhoblitt]

It is base64 in a http header, not in the userinfo url. URL parsing is RFC 2396.

That's my bad. I see that / is not part of unreserved.