bugGNUstep - Bugs: bug #43771, NSURLConnection making synchronous...

Group
 
 

bug #43771: NSURLConnection making synchronous request can't authenticate using URL's credential

Submitter:  Sergei Golovin <svg>
Submitted:  Sun 07 Dec 2014 11:13:27 AM UTC
   
 
Category:  Base/Foundation Severity:  3 - Normal
Item Group:  Bug Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 09 Mar 2016 02:52:45 PM UTC, comment #1: 

Thanks, patch applied for next release.

Richard Frith-Macdonald <CaS>
Group Member
Sun 07 Dec 2014 11:13:27 AM UTC, original submission:  

If you run under a debugger the tool 'test06' (from the attached patch)
with a breakpoint on the line NSURLConnection.m:267 then you will get
the following frame:

----------------------------------------------------
Breakpoint 1, -[NSObject(NSURLConnectionDelegate) connection:didReceiveAuthenticationChallenge:] (self=0x7367b0,
    _cmd=0x7ffff7d8b9f0 <_OBJC_SELECTOR_TABLE+688>, connection=0x737220, challenge=0x7f38f0) at NSURLConnection.m:267
(gdb) l
262     }
263
264     - (void) connection: (NSURLConnection *)connection
265       didReceiveAuthenticationChallenge: (NSURLAuthenticationChallenge *)challenge
266     {
267       [[challenge sender]
268         continueWithoutCredentialForAuthenticationChallenge: challenge];
269     }
270
271     - (void) connection: (NSURLConnection *)connection
----------------------------------------------------

In this method the code logic commands to continue without a credential.
It doesn't make a check on whether there is a proposed credential or
the failure count. However if you climb up 2 frames then you will get to:

----------------------------------------------------
#2  0x00007ffff7908bda in -[_NSHTTPURLProtocol _got:] (self=0x780bb0, _cmd=0x7ffff7d92720 <_OBJC_SELECTOR_TABLE+2144>,
    stream=0x783ad0) at NSURLProtocol.m:1163
----------------------------------------------------

then there before entering into:

----------------------------------------------------
[this->client URLProtocol: self
=>              didReceiveAuthenticationChallenge: _challenge];
----------------------------------------------------

is the code chunk which makes a proposed credential from the request's URL:

----------------------------------------------------
                  _credential = [[NSURLCredential alloc]
                    initWithUser: [url user]
                    password: [url password]
                    persistence: NSURLCredentialPersistenceForSession];
     ....
           ....
             _challenge = [[NSURLAuthenticationChallenge alloc]
                initWithProtectionSpace: space
                proposedCredential: _credential
                previousFailureCount: failures
                failureResponse: _response
                error: nil
                sender: self];
----------------------------------------------------

So currently if the library user provides a valid credential in the URL (e.g.
"http://login:password@localhost:54321") it wouldn't be used. Synchronous
requests to such a URL will fail.

The attached patch's summary:

    * Source/NSURLConnection.m:
      - fixed a bug... NSURLConnection couldn't make synchronous load
        using URL's credential;

    * Tests/base/NSURLConnection/test06.m:
      - added a new test on synchronous load with authentication by
        URL's credential;

    * Tests/base/NSURLConnection/Helpers/RequestHandler.m:
      - fixed a bug.... the Handler200 didn't supply a valid status line;

Sergei Golovin <svg>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by CaS (Posted a comment)
  • -email is unavailable- added by svg (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-03-09 CaS StatusNone Fixed
        Open/ClosedOpen Closed
    2014-12-07 svg Attached File- Added NSURLConnection_synchro_with_auth.patch, #32615

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code