You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When using the Authorization header with Basic authentication, if the username and password contain special characters like backtick (`) or $, the value of the variable following the dollar sign is being interpreted before it is passed to base64, resulting in unexpected 401 errors.
Workaround is to perform the base64 conversion with a separate tool and use the base64 string directly in the http file.
Affected code is here (BasicAuthReplacer.ts):
return Basic ${Buffer.from(${match.groups.user}:${match.groups.password}).toString('base64')};
The text was updated successfully, but these errors were encountered:
glitch8eda
changed the title
Basic auth replacer not working if user/pass contains special characters such as `$ (also a security issue: code injection)
Basic auth replacer not working if user/pass contains special characters such as ` or $ (also a security issue: code injection)
Nov 13, 2024
When using the Authorization header with Basic authentication, if the username and password contain special characters like backtick (`) or $, the value of the variable following the dollar sign is being interpreted before it is passed to base64, resulting in unexpected 401 errors.
Workaround is to perform the base64 conversion with a separate tool and use the base64 string directly in the http file.
Affected code is here (BasicAuthReplacer.ts):
return
Basic ${Buffer.from(
${match.groups.user}:${match.groups.password}).toString('base64')}
;The text was updated successfully, but these errors were encountered: