On 16/10/2013 19:09, Cédric Krier wrote:
> On 16/10/13 16:42 -0000, Code Review - New issues: ced wrote:
>> tryton: Quote user and password in the roundup XML-RPC URL
>>
>> URL: http://codereview.tryton.org/1143002/
>
> I'm requesting expert knowledge, is it right to use quote_plus or
> just quote is fine?
"quote" method with default parameter is not fine because "/" is not
quoted. "/" is not allowed ("/" is not included in sub-delims [1]). An
exception occurs when a password containing "/" and "urllib.quote"
method are used.
"quote_plus" method quote "+", this is not fine: "+" is allowed ("+" is
included in sub-delims [1]). The XMLRPC server responds 403 when
"urllib.quote_plus" and a password containing space and "+" are used.
The best call seems quote(userinfo, "!$&'()*+,;=:") (ie sub-delims and
":". That is what is used by GLib [2].
Note that when password contains ":" both of the following doesn't work
(XMLRPC server returns 200 with an empty body).
url = \
"https://%s:%s@%s"; % ((quote(user, allowed), quote(pwd, allowed), url))
url = \
"https://%s@%s"; % (quote('%s:%s' % (user, pwd), allowed), url)
Simple test script:
> import xmlrpclib from urllib import quote
>
> user = 'XXX'
> pwd = """XXX"""
> url = 'roundup-xmlrpc.tryton.org'
> allowed = "!$&'()*+,;=:"
>
> url = \
> "https://%s:%s@%s"; % \
> ((quote(user, allowed), quote(pwd, allowed), url))
>
> # url = \
> # "https://%s@%s"; % \
> # (quote('%s:%s' % (user, pwd), allowed), url)
>
> print url
> server = xmlrpclib.Server(url, allow_none=True,
> verbose=True)
> server.lookup('user','pilou')
[1] http://tools.ietf.org/html/rfc3986#appendix-A
[2]
https://developer.gnome.org/glib/stable/glib-URI-Functions.html#G-URI-RESERVED-CHARS-ALLOWED-IN-USERINFO:CAPS
--
Pierre-Louis Bonicoli
https://projects.bioecoforests.com
