Merge pull request #2425 from tgstation/ColonsInPasswordsRegressionTestAnd6.19.2Release [TGSDeploy]

v6.19.2: Fix colons in passwords

Fixes #2423

.github/workflows/ci-pipeline.yml

@@ -1776,7 +1776,7 @@ jobs:
       - name: Setup Release Artifacts
         run: |
           mkdir release_assets
-          cp ./swaggger/tgs_api.json ./release_assets/swagger.json
+          cp ./swagger/tgs_api.json ./release_assets/swagger.json
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b

build/Version.props

@@ -3,7 +3,7 @@
   <!-- Integration tests will ensure they match across the board -->
   <Import Project="WebpanelVersion.props" />
   <PropertyGroup>
-    <TgsCoreVersion>6.19.1</TgsCoreVersion>
+    <TgsCoreVersion>6.19.2</TgsCoreVersion>
     <TgsConfigVersion>5.9.0</TgsConfigVersion>
     <TgsRestVersion>10.14.0</TgsRestVersion>
     <TgsGraphQLVersion>0.7.0</TgsGraphQLVersion>

src/DMAPI/tgs/LICENSE

@@ -1,6 +1,6 @@
 The MIT License
 
-Copyright (c) 2017-2024 Jordan Brown
+Copyright (c) 2017-2026 Jordan Brown
 
 Permission is hereby granted, free of charge,
 to any person obtaining a copy of this software and

src/Tgstation.Server.Api/ApiHeaders.cs

@@ -309,7 +309,7 @@ namespace Tgstation.Server.Api
 									break;
 								}
 
-								var basicAuthSplits = joinedString.Split(ColonSeparator, StringSplitOptions.RemoveEmptyEntries);
+								var basicAuthSplits = joinedString.Split(ColonSeparator, 2, StringSplitOptions.RemoveEmptyEntries);
 								if (basicAuthSplits.Length < 2)
 								{
 									AddError(HeaderErrorTypes.AuthorizationInvalid, badBasicAuthHeaderMessage);

tests/Tgstation.Server.Api.Tests/TestApiHeaders.cs

@@ -1,9 +1,11 @@
-using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Http.Headers;
-using Microsoft.VisualStudio.TestTools.UnitTesting;
-using System;
+using System;
 using System.Net.Http.Headers;
 using System.Net.Mime;
+using System.Text;
+
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http.Headers;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
 
 using Tgstation.Server.Api.Models;
 using Tgstation.Server.Api.Models.Response;
@@ -16,7 +18,7 @@ namespace Tgstation.Server.Api.Tests
 	[TestClass]
 	public sealed class TestApiHeaders
 	{
-		readonly ProductHeaderValue productHeaderValue = new ("Tgstation.Server.Api.Tests", "1.0.0");
+		readonly ProductHeaderValue productHeaderValue = new("Tgstation.Server.Api.Tests", "1.0.0");
 
 		[TestMethod]
 		public void TestConstruction()
@@ -44,7 +46,8 @@ namespace Tgstation.Server.Api.Tests
 				};
 
 				return new ApiHeaders(new RequestHeaders(headers), false, false);
-			};
+			}
+			;
 
 			var header = TestHeader(BrowserHeader);
 			Assert.AreEqual(BrowserHeader, header.RawUserAgent);
@@ -56,5 +59,28 @@ namespace Tgstation.Server.Api.Tests
 
 			Assert.ThrowsExactly<HeadersException>(() => TestHeader(String.Empty));
 		}
+
+		[TestMethod]
+		public void TestBasicAuthenticationDeserialization()
+		{
+			const string BrowserHeader = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36.";
+			const string Password = "askdjf::SDokjdf**";
+			const string Username = "deeznuts";
+
+			var authHeader = $"Basic {Convert.ToBase64String(Encoding.UTF8.GetBytes($"{Username}:{Password}"))}";
+			var headers = new HeaderDictionary
+				{
+					{ "Accept", MediaTypeNames.Application.Json },
+					{ "Api", "Tgstation.Server.Api/4.0.0.0" },
+					{ "Authorization", authHeader },
+					{ "User-Agent", BrowserHeader },
+				};
+
+			var header = new ApiHeaders(new RequestHeaders(headers), false, false);
+
+			Assert.AreEqual(BrowserHeader, header.RawUserAgent);
+			Assert.AreEqual(Username, header.Username);
+			Assert.AreEqual(Password, header.Password);
+		}
 	}
 }