opensearch-project / opensearch-project/opensearch-ruby
[BUG] Client doesn't handle basic auth passwords with special characters in url correctly
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 114
- Forks
- 60
- PR merge metrics
- No merged PRs in 30d
Description
What is the bug?
It seems like OpenSearch::Client doesn't handle hosts/urls that contain passwords in the url with special characters correctly. When making requests with one of these urls, I get an "Unauthorized" error. I believe the problem is that __parse_host doesn't decode the special characters.
How can one reproduce the bug?
Example code snippet:
client = OpenSearch::Client.new(
url: "https://user:pass%7D%7Dword@host.docker.internal:15000",
transport_options: { ssl: { verify: false } }
)
client.search(index: '_all', body: {})
I can however get around this problem by passing a hash in the url parameter that does the decoding myself:
url = URI("https://user:pass%7D%7Dword@host.docker.internal:15000")
client = OpenSearch::Client.new(
url: {
scheme: url.scheme,
user: CGI.unescape(url.user),
password: CGI.unescape(url.password),
host: url.host,
path: url.path,
port: url.port
},
transport_options: { ssl: { verify: false } }
)
client.search(index: '_all', body: {})
What is the expected behavior?
I expect that passwords embedded in the url with standard url encoding should not cause authentication errors
What is your host/environment?
- OS: macOS 12.3.1
- Version: 1.0.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in opensearch-transport/lib/opensearch/transport/client.rb at __parse_host, using the reported OpenSearch::Client URL as the reproduction case. Check how the encoded password is handled before authentication, then verify that the example request succeeds without manually constructing a URL hash.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100