net/url: Parse accepts invalid userinfo strings

[bradfitz]

@adamdecaf reported that net/url.Parse accepts URLs with userinfo components containing just about anything (newlines and random non-ASCII Unicode).

This could be a security problem if people use the resulting URL.User.Username & Password without further validation.

[gopherbot]

Change https://golang.org/cl/87038 mentions this issue: net/url: reject invalid userinfo values when parsing URLs

[andybons]

CL 88535 OK for Go 1.9.3.

[gopherbot]

Change https://golang.org/cl/88535 mentions this issue: [release-branch.go1.9] net/url: reject invalid userinfo values when parsing URLs

[andybons]

go1.9.3 has been packaged and includes:

• CL 88535 [release-branch.go1.9] net/url: reject invalid userinfo values when parsing URLs

The release is posted at golang.org/dl.

— golang.org/x/build/cmd/releasebot, Jan 22 21:02:59 UTC

[ernsheong]

My application stopped talking to the database. Turns out database password contained a [ which isn't whitelisted 😭 Bad idea to have symbols in DB password I guess.

[adamdecaf]

Oh.. How were you parsing/handling the uri?

[ernsheong]

I was using https://github.com/jackc/pgx, which was using net/url to do it

[adamdecaf]

Percent encoding passes fine for me. From https://stackoverflow.com/questions/23353623/how-to-handle-special-characters-in-the-password-of-a-postgresql-url-connection

package main

import (
	"fmt"
	"net/url"
)

func main() {
	// raw := "postgresql://daniel:p$ass@localhost/test"
	raw := "postgresql://daniel:p%24ass@localhost"

	fmt.Printf("RAW: %q\n", raw)
	u, err := url.Parse(raw)
	if err != nil {
		fmt.Printf("ERROR: %v\n", err)
	}
	fmt.Println(u.String())
}

$ go run /tmp/jdbc.go 
RAW: "postgresql://daniel:p%24ass@localhost"
postgresql://daniel:p$ass@localhost

Edit: I tried with ] also.

$ go run /tmp/jdbc.go 
RAW: "postgresql://daniel:p%5Bass@localhost"
postgresql://daniel:p%5Bass@localhost

[AlphaWong]

I would like to know did all those changes pass the test in OSX as I can get an & operator in arch Linux but my workmate get a \u0026 in his macbook.

After I use the docker image 1.8-apline
This issue got.

I will update the screen shot later