From: Amos Jeffries <yadij@users.noreply.github.com>
Date: Sun, 23 Jun 2019 15:15:56 +0000 (+0000)
Subject: Remove userinfo support from old protocols (#419)
X-Git-Tag: SQUID_5_0_1~77
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0d0f51610c314915ffa5980aff2788d13622ee2b;p=thirdparty%2Fsquid.git

Remove userinfo support from old protocols (#419)

RFC 1738 defines the URL schemes for gopher and wais as not
having the userinfo@ segment.

coap, coaps, whois and cache_object also do not use this segment.

For these cases we can obey the RFC7230 requirement to ignore the
segment when producing normalized absolute URL.

Of the supported protocols only FTP requires userinfo, and because
we cannot be certain for unknown protocols allow it as well.
---

diff --git a/src/anyp/Uri.cc b/src/anyp/Uri.cc
index 12b1aafd41..6ce8d9ba25 100644
--- a/src/anyp/Uri.cc
+++ b/src/anyp/Uri.cc
@@ -495,10 +495,10 @@ AnyP::Uri::absolute() const
         absolute_.append(":",1);
         if (getScheme() != AnyP::PROTO_URN) {
             absolute_.append("//", 2);
-            const bool omitUserInfo = getScheme() == AnyP::PROTO_HTTP ||
-                                      getScheme() == AnyP::PROTO_HTTPS ||
-                                      userInfo().isEmpty();
-            if (!omitUserInfo) {
+            const bool allowUserInfo = getScheme() == AnyP::PROTO_FTP ||
+                                       getScheme() == AnyP::PROTO_UNKNOWN;
+
+            if (allowUserInfo && !userInfo().isEmpty()) {
                 absolute_.append(userInfo());
                 absolute_.append("@", 1);
             }