Uri::getBaseUrl() should escape @ in password

[Rudloff]

Hello,

Some user decided to use my app behind an Apache basic auth and some of the libraries I use started throwing errors about URLs. Turns out it was because they had a @ in their password.

And inded this code:

$url = new \Slim\Http\Uri('https', 'example.com', 443, '/', '', '', 'foo', 'b@r');
$url->getBaseUrl();

returns https://foo:b@[email protected].

But according the URL standard, the user and password should be percent-encoded: https://foo:b%[email protected].

[akrabat]

I'm not sure that the URL Standard is an actual RFC.

However, I can see the argument that we should percent-encode at least the @ sign if it's in the user or password fields.

This URL Standard suggests percent-encoding all these characters:

U+0020 SPACE, U+0022 ("), U+0023 (#), U+003C (<), U+003E (>), U+003F (?), U+0060 (`),
U+007B ({), and U+007D (}), U+002F (/), U+003A (:), U+003B (;), U+003D (=), U+0040 (@),
U+005B ([), U+005C (\), U+005D (]), U+005E (^), and U+007C (|) 

If we did this, will we break BC?

[Rudloff]

Note that the W3C HTML validator also complains about this if such an URL is used in a href attribute.
Bad value http://foo:b@[email protected] for attribute href on element a: User or password contains an at symbol ("@") not percent-encoded.

[geggleto]

@akrabat in theory a password could contain any of those values. I would still think this would be fine as it is a bug-fix...

[RyanNerd]

@akrabat @geggleto Is this still an open issue? If so I can work on it (have some time on my hands right now)...

[akrabat]

This should be fixed, yes @RyanNerd

[akrabat]

Actually, see #2207 - this is needed for Slim 3 too.

[X-Tender]

I don't know if the output of the user:password@ values are still necessary or "up to date" because in Chrome you get an Deperacation error and the whole website don't work because Chrome blocks all traffic which goes through the base url.

[Deprecation] Subresource requests whose URLs contain embedded credentials (e.g. `https://user:pass@host/`) are blocked. See https://www.chromestatus.com/feature/5669008342777856 for more details.