exchange

commit a885a8da71d5b0131075adeafe43fd3151e8099d
parent 5b26f3610731ddd4d073fcdad101c4caffed8b81
Author: Christian Grothoff <grothoff@gnunet.org>
Date:   Mon, 17 Aug 2026 17:08:37 +0200

check for allowed characters in username/password

Diffstat:
M
src/bank-lib/bank_api_common.c
 | 
46
++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 46 insertions(+), 0 deletions(-)
diff --git a/src/bank-lib/bank_api_common.c b/src/bank-lib/bank_api_common.c
@@ -22,6 +22,36 @@
 #include "bank_api_common.h"
 
 
+/**
+ * Check that @a str is usable in the credentials of an HTTP
+ * "Basic" authentication header as per RFC 7617.  Section 2
+ * forbids a colon in the user-id (it separates user-id and
+ * password, and there is no escaping mechanism), Section 2.1
+ * forbids control characters in either field.
+ *
+ * @param str string to check, non-NULL
+ * @param allow_colon true if @a str may contain a colon
+ * @return true if @a str is acceptable
+ */
+static bool
+valid_basic_credential (const char *str,
+                        bool allow_colon)
+{
+  for (const char *p = str; '\0' != *p; p++)
+  {
+    unsigned char c = (unsigned char) *p;
+
+    if ( (c < 0x20) ||
+         (0x7F == c) )
+      return false;
+    if ( (':' == c) &&
+         (! allow_colon) )
+      return false;
+  }
+  return true;
+}
+
+
 enum GNUNET_GenericReturnValue
 TALER_BANK_setup_auth_ (CURL *easy,
                         const struct TALER_BANK_AuthenticationData *auth)
@@ -37,6 +67,22 @@ TALER_BANK_setup_auth_ (CURL *easy,
     {
       char *up;
 
+      if (! valid_basic_credential (auth->details.basic.username,
+                                    false))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Username for HTTP basic authentication must not contain"
+                    " a colon or control characters (see RFC 7617)\n");
+        return GNUNET_SYSERR;
+      }
+      if (! valid_basic_credential (auth->details.basic.password,
+                                    true))
+      {
+        GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+                    "Password for HTTP basic authentication must not contain"
+                    " control characters (see RFC 7617)\n");
+        return GNUNET_SYSERR;
+      }
       GNUNET_asprintf (&up,
                        "%s:%s",
                        auth->details.basic.username,