Infinity loop when wrong credentials supplied
This case only happened when I supplied wrong credentials.
How to reproduce:
Create web service use MHD (I took from MHD/src/examples):
#include "platform.h"
#include <microhttpd.h>
#ifdef _WIN32
#ifndef WIN32_LEAN_AND_MEAN
#define WIN32_LEAN_AND_MEAN 1
#endif /* !WIN32_LEAN_AND_MEAN */
#include <windows.h>
#endif
#define PAGE "<html><head><title>libmicrohttpd demo</title></head><body>libmicrohttpd demo</body></html>"
#define DENIED "<html><head><title>Access denied</title></head><body>Access denied</body></html>"
static int
ahc_echo (void *cls,
struct MHD_Connection *connection,
const char *url,
const char *method,
const char *version,
const char *upload_data, size_t *upload_data_size, void **ptr)
{
static int aptr;
const char *me = cls;
struct MHD_Response *response;
int ret;
char *user;
char *pass;
int fail;
if (0 != strcmp (method, "GET"))
return MHD_NO; /* unexpected method */
if (&aptr != *ptr)
{
/* do never respond on first call */
*ptr = &aptr;
return MHD_YES;
}
*ptr = NULL; /* reset when done */
/* require: "Aladdin" with password "open sesame" */
pass = NULL;
user = MHD_basic_auth_get_username_password (connection, &pass);
fail = ( (user == NULL) || (0 != strcmp (user, "Aladdin")) || (0 != strcmp (pass, "open sesame") ) );
if (fail)
{
response = MHD_create_response_from_buffer (strlen (DENIED),
(void *) DENIED,
MHD_RESPMEM_PERSISTENT);
ret = MHD_queue_basic_auth_fail_response (connection,"TestRealm",response);
}
else
{
response = MHD_create_response_from_buffer (strlen (me),
(void *) me,
MHD_RESPMEM_PERSISTENT);
ret = MHD_queue_response (connection, MHD_HTTP_OK, response);
}
if (NULL != user)
free (user);
if (NULL != pass)
free (pass);
MHD_destroy_response (response);
return ret;
}
int
main (int argc, char *const *argv)
{
struct MHD_Daemon *d;
unsigned int port;
if ( (argc != 2) ||
(1 != sscanf (argv[1], "%u", &port)) ||
(UINT16_MAX < port) )
{
fprintf (stderr,
"%s PORT\n", argv[0]);
return 1;
}
d = MHD_start_daemon (MHD_USE_THREAD_PER_CONNECTION | MHD_USE_INTERNAL_POLLING_THREAD | MHD_USE_ERROR_LOG,
atoi (argv[1]),
NULL, NULL, &ahc_echo, PAGE, MHD_OPTION_END);
if (d == NULL)
return 1;
fprintf (stderr, "HTTP server running. Press ENTER to stop the server\n");
(void) getc (stdin);
MHD_stop_daemon (d);
return 0;
}
make authorization_example
./authorization_example 8000
Then I run wget2:
wget2 -d http://localhost:8000 --user=Aladdin --password="wrong password"
Then infinity loop happened. Is Wget2 allowed to do so?
I also did testing using Wget1, the result is different. They exit after first attempt matching the credentials.
If yes, then maybe I need to remove my test for wrong credentials in authentication testing [0]. Because, I feel this scenario maybe allowed when using interactive programs like Elinks or GUI browser.
FYI, after doing git bisect, I found this case first introduced in commit [1].
[0] https://gitlab.com/gnuwget/wget2/merge_requests/265
[1] https://gitlab.com/gnuwget/wget2/commit/55d8fc05156d4f7df56cea0dc688cfb885f3aca1