bitflicker64 commented on code in PR #3290:
URL: https://github.com/apache/hugegraph/pull/3290#discussion_r4217948142
##########
hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/cypher/CypherAPI.java:
##########
@@ -159,7 +159,7 @@ private Pair<String, String> toUserPass(String auth) {
String encoded = auth.substring(basic.length());
byte[] userPass = this.decoder.decode(encoded);
String authorization = new String(userPass, UTF8);
- split = authorization.split(":");
+ split = authorization.split(":", 2);
Review Comment:
Minor: This is a second, independent Basic-credential parser, and the change
here is only checked by hand (the PR description reports a manual `a:b:c`
request). `testBasicAuthWithNonAsciiOrColonPassword` calls
`graphspaces/DEFAULT/graphs`, which goes through `AuthenticationFilter` only,
so reverting this line to `split(":")` would leave every test green while colon
passwords pass the filter and then fail in `toUserPass` (split length 3,
returns null, `E.checkNotNull` throws). Please add a case to `CypherApiTest`
that sends a hand-built UTF-8 Basic header for a user whose password contains a
colon and expects 200 from the Cypher endpoint.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
