wps_forward_bot
🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 `_HttpBasicAuth._get_username_and_password` must not unquote `%` chars (#1331)
Currently, we incorrectly use unquote in the auth:
django-modern-rest/dmr/security/http.py
Lines 60 to 76 in a2d44b1
This is a problem, because now these two passwords are the same:
>>> from base64 import b64decode, b64encode
>>> from urllib.parse import unquote
>>> unquote(b64decode(b64encode(b'test_%40')).decode())
'test_@'
>>> unquote(b64decode(b64encode(b'test_@')).decode())
'test_@'
But, the thing is that https://www.rfc-editor.org/info/rfc7617/ does not say that this unquoting is needed.
I just copied this errors from somewhere else. This needs to be fixed.
(please, do not take this issue before the 1st of September)
#bug #good_first_issue #help_wanted #security #opensource_september #django_modern_rest
sent via relator
1 · 214 ·