qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-09-29 20:34:36 -06:00
Code Releases Activity

net/http: strip escaped password from error

Browse Source 
Using password that returns from User.Password() won't work in this case
because password in Userinfo already unescaped. The solution is uses
User.String() to escape password back again and then stringify it to error.

Fixes #31808

Change-Id: I723aafd5a57a5b69f2dd7d3a21b82ebbd4174451
Reviewed-on: https://go-review.googlesource.com/c/go/+/175018
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
This commit is contained in:
Thanabodee Charoenpiriyakij 2019-05-03 11:41:54 +07:00 committed by Brad Fitzpatrick
parent f5c43b9194
commit 2c67cdf7cf
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/net/http/client.go
View File

@ -926,10 +926,9 @@ func isDomainOrSubdomain(sub, parent string) bool {
}
func stripPassword(u *url.URL) string {
pass, passSet := u.User.Password()
_, passSet := u.User.Password()
if passSet {
return strings.Replace(u.String(), pass+"@", "***@", 1)
return strings.Replace(u.String(), u.User.String()+"@", u.User.Username()+":***@", 1)
}
return u.String()
}

5
src/net/http/client_test.go
View File

@ -1184,6 +1184,11 @@ func TestStripPasswordFromError(t *testing.T) {
in: "http://user:password@dummy.faketld/password",
out: "Get http://user:***@dummy.faketld/password: dummy impl",
},
{
desc: "Strip escaped password",
in: "http://user:pa%2Fssword@dummy.faketld/",
out: "Get http://user:***@dummy.faketld/: dummy impl",
},
}
for _, tC := range testCases {
t.Run(tC.desc, func(t *testing.T) {