Unescape username/passwords obtained from URLs before using them for HTTP aut...

Unescape username/passwords obtained from URLs before using them for HTTP auth.

BUG=http://crbug.com/19200


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=23403

[eroman, 2009-08-13 19:48:34]

brettw: please review
wtc: FYI, since you had written a TODO on this.

[brettw, 2009-08-13 20:03:34]

http://codereview.chromium.org/164504/diff/13/1006
File net/http/http_network_transaction.cc (right):

http://codereview.chromium.org/164504/diff/13/1006#newcode1715
Line 1715: *username = UnescapeAndDecodeUTF8URLComponent(url.username(), flags);
Just making sure you're sure you know what you want here. I would expect that
the username/password get sent over HTTP as 8-bit. This says to me that the
strings everywhere should be 8-bit, and you shouldn't try to interpret it as
UTF-8 here. Do you know if this is correct? Maybe we should ask wtc?

[eroman, 2009-08-13 20:35:36]

http://codereview.chromium.org/164504/diff/13/1006
File net/http/http_network_transaction.cc (right):

http://codereview.chromium.org/164504/diff/13/1006#newcode1715
Line 1715: *username = UnescapeAndDecodeUTF8URLComponent(url.username(), flags);
On 2009/08/13 20:03:34, brettw wrote:
> Just making sure you're sure you know what you want here. I would expect that
> the username/password get sent over HTTP as 8-bit. This says to me that the
> strings everywhere should be 8-bit, and you shouldn't try to interpret it as
> UTF-8 here. Do you know if this is correct? Maybe we should ask wtc?

right, this should be kosher.

username/password are inputtable by the user from dialogs, and hence are wide
strings. entry of credentials via URL (rather than dialog box) is just a
variation of that technique.

the network module's http auth module expects username/password to be provided
as wide strings. (so it is fine to provide non-ascii inputs).

lastly, under the hood the various http auth modules use the username/password
to form  a credential, which is an narrow (8-bit) string. therefore it is also
true that username/passwords are sent over the wire as 8-bit strings (as part of
some hashed credential blob).

[brettw, 2009-08-13 20:38:52]

LGTM then

[wtc, 2009-08-13 21:37:36]

Darin, could you review this CL?

http://codereview.chromium.org/164504/diff/13/1006
File net/http/http_network_transaction.cc (left):

http://codereview.chromium.org/164504/diff/13/1006#oldcode1670
Line 1670: // TODO(wtc) It may be necessary to unescape the username and
password
I wrote this TODO(wtc) based on what Darin told me, without
really understanding it.  So it would be nice to have Darin
review this.

http://codereview.chromium.org/164504/diff/13/1007
File net/http/http_network_transaction.h (right):

http://codereview.chromium.org/164504/diff/13/1007#newcode266
Line 266: static void GetIdentifyFromUrl(const GURL& url,
Consider moving this method to net_util.h, so that we don't
need to add new FRIEND_TESTs.

Nit: Use "URL" in the function's name.