entrouvert/wcs
entrouvert
/
wcs
15
1
Fork 0
Code Issues Pull Requests 24 Releases Activity

wscalls: do not auto sign URLs using HTTP basic authentication (#81303) #691

Merged
fpeters merged 1 commits from wip/81303-do-no-autosign-urls-with-basic-auth into main 2023-09-19 10:08:04 +02:00
Conversation 0 Commits 1 Files Changed 2 +12 -2
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
tests/test_wscall.py
View File

@ -104,6 +104,15 @@ def test_webservice_auto_sign(http_requests, pub):
assert 'orig=example.net' not in http_requests.get_last('url')
assert 'signature=' in http_requests.get_last('url')
# do not auto sign if there's http basic authentication
wscall.request = {'url': 'http://foo:bar@idp.example.net'}
try:
wscall.call()
except Exception:
pass
assert 'orig=example.net' not in http_requests.get_last('url')
assert 'signature=' not in http_requests.get_last('url')
def test_webservice_post_with_no_payload(http_requests, pub):
NamedWsCall.wipe()

5
wcs/wscalls.py
View File

@ -95,7 +95,9 @@ def call_webservice(
variables = get_publisher().substitutions.get_context_variables(mode='lazy')
url = get_variadic_url(url, variables)
if not request_signature_key:
parsed = urllib.parse.urlparse(url)
if not request_signature_key and '@' not in parsed.netloc:
try:
request_signature_key, orig = get_secret_and_orig(url)
except MissingSecret:
@ -106,7 +108,6 @@ def call_webservice(
qs_data['orig'] = orig
if qs_data: # merge qs_data into url
parsed = urllib.parse.urlparse(url)
qs = list(urllib.parse.parse_qsl(parsed.query))
for key, value in qs_data.items():
try: