Merge pull request #88 from browserup/fix-creds-leak

ericbeland · web-flow · commit db9abcc70ece · 2019-05-31T09:47:34.000-04:00
Bring in Credentials Leakage Fix
diff --git a/browserup-proxy-core/src/main/java/com/browserup/bup/BrowserUpProxyServer.java b/browserup-proxy-core/src/main/java/com/browserup/bup/BrowserUpProxyServer.java
@@ -376,7 +376,9 @@ public void filterRequest(HttpObject httpObject) {
                                 String chainedProxyAuth = chainedProxyCredentials;
                                 if (chainedProxyAuth != null) {
                                     if (httpObject instanceof HttpRequest) {
-                                        HttpHeaders.addHeader((HttpRequest)httpObject, HttpHeaderNames.PROXY_AUTHORIZATION, "Basic " + chainedProxyAuth);
+                                        if(ProxyUtils.isCONNECT(httpObject) || !((HttpRequest) httpObject).uri().startsWith("/")) {
+                                            HttpHeaders.addHeader((HttpRequest) httpObject, HttpHeaderNames.PROXY_AUTHORIZATION, "Basic " + chainedProxyAuth);
+                                        }
                                     }
                                 }
                             }

Original file line number	Diff line number	Diff line change
`@@ -376,7 +376,9 @@ public void filterRequest(HttpObject httpObject) {`
`376`	`376`	`String chainedProxyAuth = chainedProxyCredentials;`
`377`	`377`	`if (chainedProxyAuth != null) {`
`378`	`378`	`if (httpObject instanceof HttpRequest) {`
`379`		`- HttpHeaders.addHeader((HttpRequest)httpObject, HttpHeaderNames.PROXY_AUTHORIZATION, "Basic " + chainedProxyAuth);`
	`379`	`+ if(ProxyUtils.isCONNECT(httpObject) \|\| !((HttpRequest) httpObject).uri().startsWith("/")) {`
	`380`	`+ HttpHeaders.addHeader((HttpRequest) httpObject, HttpHeaderNames.PROXY_AUTHORIZATION, "Basic " + chainedProxyAuth);`
	`381`	`+ }`
`380`	`382`	`}`
`381`	`383`	`}`
`382`	`384`	`}`