regression in 1.0.4: setting host clears the user
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 125
- Forks
- 65
- Avg merge
- 6h 4m
- Merged PRs (30d)
- 2
Description
I have some code relying on the following logic:
require "uri"
uri = URI("socks4://user:@socksproxy:8080")
uri.user #=> "user"
uri.host = Resolv.getaddress("socksproxy") #=> "127.0.0.1"
uri.user #=> used to be "user", now it's nil
I understand that this was all done as a fix for a CVE to not expose passwords, but if no password is set, this resetting credentials just feels a bit odd. Also, the CVE seems more about preventing when merging two uris and leaking credentials from one to the other, and this patch does way more than that, i.e. resetting state when mutating. I don't think that they're the same.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the URI("socks4://user:@socksproxy:8080") example and the host= mutation described in the issue, comparing the 1.0.4 behavior with the earlier behavior. Review the CVE-related change and determine whether an empty password should allow the user to remain; done means resolving the host no longer removes that user without reintroducing credential exposure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100