Skip to content

fix: decode percent-encoded credentials from URL#1877

Open
NotFoundOvO wants to merge 1 commit into
httpie:masterfrom
NotFoundOvO:fix/url-credentials-decode
Open

fix: decode percent-encoded credentials from URL#1877
NotFoundOvO wants to merge 1 commit into
httpie:masterfrom
NotFoundOvO:fix/url-credentials-decode

Conversation

@NotFoundOvO

Copy link
Copy Markdown

Summary

When credentials are percent-encoded in the URL (e.g. http://u%40d:***@host/), Python's urlsplit() preserves the percent-encoding in .username and .password attributes. This causes HTTPie to send the raw encoded string (u%40d) as the username instead of the decoded value (u@d).

This PR applies urllib.parse.unquote() to decode URL credentials before passing them to the auth handler, matching curl's behavior.

Changes

  • Import unquote from urllib.parse in argparser.py
  • Apply unquote() to url.username and url.password in _process_auth()

Reproduction

# Before fix: returns 401 (wrong credentials)
http https://u%40d:***@httpbin.org/basic-auth/u%40d/1%3d2%3f

# After fix: returns 200 (credentials correctly decoded)
http https://u%40d:***@httpbin.org/basic-auth/u%40d/1%3d2%3f

Closes #1623

When credentials are passed in the URL (e.g. http://u%40d:***@host/),
Python's urlsplit() preserves the percent-encoding in .username and
.password attributes. Apply urllib.parse.unquote() to decode them
before passing to the auth handler.

This matches curl's behavior and fixes httpie#1623.
@NotFoundOvO

Copy link
Copy Markdown
Author

Hi, I noticed the CI test failures across all platforms. After checking, the same failures (Tests + Coverage) are also present on the branch — this appears to be a pre-existing CI infrastructure issue, not related to this change.

The code change itself (using to decode percent-encoded URL credentials) is straightforward and correct. does not auto-decode percent-encoded username/password, so the explicit is needed.

Would appreciate it if someone could take a look when the CI is fixed. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Username/password in the URL not decoded when used for basic authentication

2 participants