media icon indicating copy to clipboard operation
media copied to clipboard

Fixed removal of user info for URLs that contain encoded @ characters

Open Lavamancer opened this issue 1 year ago • 2 comments

This bug occurs when using email addresses encoded as the user (i.e: rtsp://user%40name:[email protected]/foo.mkv)

The solution is simply to use the getEncodedAuthority method instead of getAuthority. This resolves the issue because getAuthority decodes the encoded "@" symbols before splitting, resulting in a malformed URL.

Malformed URL example: rtsp://name:pass/foo.mkv

After the fix, it properly returns: rtsp://foo.bar/foo.mkv

Lavamancer avatar Feb 28 '24 16:02 Lavamancer

Instead of manually splitting the encoded authority on @ in order to remove the user-info and leave just the host and port, I wonder if it would instead be better to manually concatenate uri.getHost() and uri.getPort(). Then we let the Uri class deal with the splitting and encoding issues. Would that still allow your test case to pass?

icbaker avatar Feb 28 '24 16:02 icbaker

The removeUserInfo method is used with the confidence that it will only remove that part since some URLs not only contain host and port but also path, query parameters, etc. The current issue of certain %40 being converted to @ has been resolved, allowing emails to be used as usernames in the user information.

Lavamancer avatar Feb 29 '24 09:02 Lavamancer