3 captures
07 Mar 2021 - 20 May 2022
Apr MAY Jun
20
2021 2022 2023
success
fail

About this capture

COLLECTED BY

Organization: Archive Team

Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.

History is littered with hundreds of conflicts over the future of a community, group, location or business that were "resolved" when one of the parties stepped ahead and destroyed what was there. With the original point of contention destroyed, the debates would fall to the wayside. Archive Team believes that by duplicated condemned data, the conversation and debate can continue, as well as the richness and insight gained by keeping the materials. Our projects have ranged in size from a single volunteer downloading the data to a small-but-critical site, to over 100 volunteers stepping forward to acquire terabytes of user-created data to save for future generations.

The main site for Archive Team is at archiveteam.org and contains up to the date information on various projects, manifestos, plans and walkthroughs.

This collection contains the output of many Archive Team projects, both ongoing and completed. Thanks to the generous providing of disk space by the Internet Archive, multi-terabyte datasets can be made available, as well as in use by the Wayback Machine, providing a path back to lost websites and work.

Our collection has grown to the point of having sub-collections for the type of data we acquire. If you are seeking to browse the contents of these collections, the Wayback Machine is the best first stop. Otherwise, you are free to dig into the stacks to see what you may find.

The Archive Team Panic Downloads are full pulldowns of currently extant websites, meant to serve as emergency backups for needed sites that are in danger of closing, or which will be missed dearly if suddenly lost due to hard drive crashes or server failures.

Collection: Archive Team: URLs

TIMESTAMPS

The Wayback Machine - http://web.archive.org/web/20220520212846/https://bugs.ruby-lang.org/issues/17542
 


Project

General

Profile

 




Register
 

Home
Projects
Help

 
Ruby master
All Projects
 

Ruby » Ruby master



Overview
Activity
Roadmap
Issues
Wiki
Repository




Custom queries


Backport 2.2

Backport 2.3

Backport 2.4

Backport 2.5

Backport 2.6

Backport 2.7

Backport 3.0

Backport 3.1

bugs: unassigned

DevelopersMeeting

matz
 


Actions
 Copy link  

Bug #17542

closed




Username and password are not decoded if retrieved from env



Added by leipert (Lukas Eipert) over 1 year ago.  Updated 12 months ago.  


Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-

ruby -v:
ruby 2.7.2p137 (2020-10-01 revision 5445e04352) [x86_64-darwin18]
\d\.\d(\.0)?: (UNKNOWN|REQUIRED|DONE|DONTNEED|WONTFIX))(, \g)*\z/" class="field-description">Backport:
2.6: UNKNOWN, 2.7: UNKNOWN, 3.0: UNKNOWN
[ruby-core:102089] 





Description


If someone sets an env variable defining a http_proxy (ENV['http_proxy']), containing a
username / password with percent-encoded characters, then the resulting
base64 encoded auth header will be wrong.

For example, suppose a username is Y\X and the password is R%S] ?X.
Properly URL encoded the proxy url would be:
http://Y%5CX:R%25S%5D%20%3FX@proxy.example:8000

The resulting proxy auth header should be: WVxYOlIlU10gP1g=, but the
getters defined by ruby StdLib URI return a username Y%5CX and
password R%25S%5D%20%3FX, resulting in WSU1Q1g6UiUyNVMlNUQlMjAlM0ZY.
As a result the proxy will deny the request.

Please note that this is my first contribution to the ruby ecosystem, to
standard lib especially and I am not a ruby developer. I don't
understand ruby's encoding system and the code is not properly
ruby-esque. Sorry for that and a happy and healthy 2021!


The description above is taken from: https://github.com/ruby/net-http/pull/5

References:


https://gitlab.com/gitlab-org/gitlab/-/issues/289836

https://bugs.ruby-lang.org/projects/ruby-master/repository/trunk/revisions/58461

https://bugs.ruby-lang.org/issues/12921

 






History

Notes
 





Actions
Copy link
 #1  [ruby-core:103641]  

Updated by nagachika (Tomoyuki Chikanaga) about 1 year ago  



Backport changed from 2.5: UNKNOWN, 2.6: UNKNOWN, 2.7: UNKNOWN, 3.0: UNKNOWNto2.6: REQUIRED, 2.7: REQUIRED, 3.0: REQUIRED

Status changed from OpentoClosed
 

fixed at 842f00f45212019a3b07f8d8dac269d35beb9efa
 




Actions
Copy link
 #2  [ruby-core:104094]  

Updated by nagachika (Tomoyuki Chikanaga) 12 months ago  



Backport changed from 2.6: REQUIRED, 2.7: REQUIRED, 3.0: REQUIREDto2.6: UNKNOWN, 2.7: UNKNOWN, 3.0: UNKNOWN
 

withdrawn backport request for now.
I think this is a spec change in practice even if the prior behavior violates any standards.
If you have any objections, please let me know.
 





Actions
 Copy link  


Also available in: Atom  PDF




Powered by Redmine © 2006-2022 Jean-Philippe Lang