actions / actions/toolkit

URL-encoding not handled for proxy username.(http-client)

Open
#1,779 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
5.9k
Forks
1.8k
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
Our Zscaler proxy requires @ to be used within the username. Because the username and password are specified as part of a URL, they must be URL-encoded by the caller; otherwise consider what would happen if the user's password or username contained an @ or a :, etc.

To Reproduce
Steps to reproduce the behavior:

  1. Self-hosted runner with http_proxy and https_proxy setup with user@name:password@proxy_url:proxy_port
  2. For URL encoding. The @ within http_proxy and https_proxy will be replaced with %40 for URL encoding
  3. http-client load the username as plain text without decoding

Expected behavior
Expect http-client decode username and password when needed.

Screenshots
Screenshot 2024-07-30 at 15 15 37

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the http-client code that parses proxy URLs and credentials, then reproduce the issue with the encoded @ in http_proxy or https_proxy. Done means username and password values are decoded when loaded from the proxy URL, while the existing proxy behavior remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.