Repository navigation
Conversation
Since 8f75402 (sqlmapproject#5875), _setHTTPHandlers() parses username:password from the proxy URL but only passes them to SOCKS. For HTTP(S) proxies the proxy string is rebuilt from --proxy-cred alone, so credentials given in --proxy or in the HTTP_PROXY environment variable are dropped and the proxy answers 407.
Member
|
Thanks. Fixed in our own commit together with the SOCKS counterpart (percent-encoded credentials from the proxy URL weren't decoded there). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to #5875.
We run sqlmap in an environment where all traffic goes through an authenticating proxy, set with
HTTP_PROXY=http://user:pass@proxy:port. After upgrading from 1.8.x to 1.10.x, every request started coming back with407 Proxy Authentication Required.I tracked it down to 8f75402 (the fix for #5875). Since that commit,
_setHTTPHandlers()parsesusername:passwordout of the proxy URL, but only the SOCKS branch uses them. For HTTP(S) proxies, the proxy string is rebuilt from--proxy-credonly, so credentials in the URL are silently dropped. It happens both with--proxyand with the environment variables. In 1.8.x the userinfo stayed glued to the hostname and urllib picked it up, which is why it used to work.The change just falls back to the parsed credentials when
--proxy-credisn't set.--proxy-credstill wins if both are given.To reproduce, point either of these at a proxy that requires Basic auth:
On master the first request goes out without a
Proxy-Authorizationheader and the run stops on the 407. With the patch every request carries the header. I also checked an HTTPS target (the header is sent onCONNECT) and a-rrequest file.Unit tests and
--smoke-testpass.