From 0ac78fb92f10093847cb9a10eab5925d09838fec Mon Sep 17 00:00:00 2001 From: Brian Quinlan Date: Thu, 5 Jun 2025 13:52:34 -0700 Subject: [PATCH] [io] Fix a bug where the proxy configuration parser did not correctly validate proxy passwords. Closes https://github.com/dart-lang/sdk/pull/60476 GitOrigin-RevId: c2f3b31db38755c7d439daa862e86c528744739c Change-Id: I498dcfae0b0c9614fc388f102f8d88630e0761ef Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/420381 Reviewed-by: Siva Annamalai Commit-Queue: Brian Quinlan --- sdk/lib/_http/http_impl.dart | 2 +- tests/standalone/io/http_proxy_test.dart | 22 ++++++++++++++++++++++ 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/sdk/lib/_http/http_impl.dart b/sdk/lib/_http/http_impl.dart index fa8a1226b1a..ff013ea463f 100644 --- a/sdk/lib/_http/http_impl.dart +++ b/sdk/lib/_http/http_impl.dart @@ -3744,7 +3744,7 @@ class _ProxyConfiguration { String userinfo = proxy.substring(0, at).trim(); proxy = proxy.substring(at + 1).trim(); int colon = userinfo.indexOf(":"); - if (colon == -1 || colon == 0 || colon == proxy.length - 1) { + if (colon == -1 || colon == 0 || colon == userinfo.length - 1) { throw HttpException("Invalid proxy configuration $configuration"); } username = userinfo.substring(0, colon).trim(); diff --git a/tests/standalone/io/http_proxy_test.dart b/tests/standalone/io/http_proxy_test.dart index 3287a7012a4..038a627762a 100644 --- a/tests/standalone/io/http_proxy_test.dart +++ b/tests/standalone/io/http_proxy_test.dart @@ -296,21 +296,43 @@ Future setupProxyServer({ipV6 = false}) { testInvalidProxy() { HttpClient client = new HttpClient(context: clientContext); + // User without password. + client.findProxy = (Uri uri) => "PROXY user@localhost:80"; + Future.value( + client.getUrl(Uri.parse("http://www.google.com/test")), + ).catchError((error) {}, test: (e) => e is HttpException); + + // User with empty password. + client.findProxy = (Uri uri) => "PROXY user:@localhost:80"; + Future.value( + client.getUrl(Uri.parse("http://www.google.com/test")), + ).catchError((error) {}, test: (e) => e is HttpException); + + // User but no username. + client.findProxy = (Uri uri) => "PROXY :password@localhost:80"; + Future.value( + client.getUrl(Uri.parse("http://www.google.com/test")), + ).catchError((error) {}, test: (e) => e is HttpException); + + // Empty proxy configuration. client.findProxy = (Uri uri) => ""; Future.value( client.getUrl(Uri.parse("http://www.google.com/test")), ).catchError((error) {}, test: (e) => e is HttpException); + // No 'PROXY' prefix. client.findProxy = (Uri uri) => "XXX"; Future.value( client.getUrl(Uri.parse("http://www.google.com/test")), ).catchError((error) {}, test: (e) => e is HttpException); + // No port. client.findProxy = (Uri uri) => "PROXY www.google.com"; Future.value( client.getUrl(Uri.parse("http://www.google.com/test")), ).catchError((error) {}, test: (e) => e is HttpException); + // Port string is non an integer. client.findProxy = (Uri uri) => "PROXY www.google.com:http"; Future.value( client.getUrl(Uri.parse("http://www.google.com/test")),