Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Basic auth replacer not working if user/pass contains special characters such as ` or $ (also a security issue: code injection) #832

Open
glitch8eda opened this issue Nov 13, 2024 · 0 comments

Comments

@glitch8eda
Copy link

glitch8eda commented Nov 13, 2024

When using the Authorization header with Basic authentication, if the username and password contain special characters like backtick (`) or $, the value of the variable following the dollar sign is being interpreted before it is passed to base64, resulting in unexpected 401 errors.

Workaround is to perform the base64 conversion with a separate tool and use the base64 string directly in the http file.

Affected code is here (BasicAuthReplacer.ts):
return Basic ${Buffer.from(${match.groups.user}:${match.groups.password}).toString('base64')};

@glitch8eda glitch8eda changed the title Basic auth replacer not working if user/pass contains special characters such as `$ (also a security issue: code injection) Basic auth replacer not working if user/pass contains special characters such as ` or $ (also a security issue: code injection) Nov 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant