|
 |
9ae52b |
commit ec0d0f39cf28da14eead0ba5e777e95855bc2f67
|
|
|
9ae52b |
Author: Amos Jeffries <yadij@users.noreply.github.com>
|
|
|
9ae52b |
Date: 2019-06-08 21:09:23 +0000
|
|
|
9ae52b |
|
|
|
9ae52b |
Fix Digest auth parameter parsing (#415)
|
|
|
9ae52b |
|
|
|
9ae52b |
Only remove quoting if the domain=, uri= or qop= parameter
|
|
|
9ae52b |
value is surrounded by double-quotes.
|
|
|
9ae52b |
|
|
|
9ae52b |
diff --git a/src/auth/digest/Config.cc b/src/auth/digest/Config.cc
|
|
|
9ae52b |
index 674dd93..d2cd2e9 100644
|
|
|
9ae52b |
--- a/src/auth/digest/Config.cc
|
|
|
9ae52b |
+++ b/src/auth/digest/Config.cc
|
|
|
9ae52b |
@@ -781,14 +781,14 @@ Auth::Digest::Config::decode(char const *proxy_auth, const char *aRequestRealm)
|
|
|
9ae52b |
if (keyName == SBuf("domain",6) || keyName == SBuf("uri",3)) {
|
|
|
9ae52b |
// domain is Special. Not a quoted-string, must not be de-quoted. But is wrapped in '"'
|
|
|
9ae52b |
// BUG 3077: uri= can also be sent to us in a mangled (invalid!) form like domain
|
|
|
9ae52b |
- if (*p == '"' && *(p + vlen -1) == '"') {
|
|
|
9ae52b |
+ if (vlen > 1 && *p == '"' && *(p + vlen -1) == '"') {
|
|
|
9ae52b |
value.limitInit(p+1, vlen-2);
|
|
|
9ae52b |
}
|
|
|
9ae52b |
} else if (keyName == SBuf("qop",3)) {
|
|
|
9ae52b |
// qop is more special.
|
|
|
9ae52b |
// On request this must not be quoted-string de-quoted. But is several values wrapped in '"'
|
|
|
9ae52b |
// On response this is a single un-quoted token.
|
|
|
9ae52b |
- if (*p == '"' && *(p + vlen -1) == '"') {
|
|
|
9ae52b |
+ if (vlen > 1 && *p == '"' && *(p + vlen -1) == '"') {
|
|
|
9ae52b |
value.limitInit(p+1, vlen-2);
|
|
|
9ae52b |
} else {
|
|
|
9ae52b |
value.limitInit(p, vlen);
|