回复：JSON-RPC 密码
原始发布页
打开来源页面查看 1 个交叉存档
引用 lachesis 于 2010 年 7 月 25 日 07:52:35 PM 的发言
我发现了一个看起来像是漏洞的问题：当用户名和密码的组合足够长时，bitcoind 中的 base64 编码器会生成如下所示的授权标头：
代码：
...
Authorization: Basic YWJiYWJiYWFiYmE6aGVsbG93b3JsZGhlbGxvd29ybGRoZWxsb3dvcmxkaGVsbG93
b3JsZGhlbGxvd29ybGRoZWxsb3dvcmxk它每隔 64 个字符插入一个换行符，这显然会破坏 Authorization 标头，因此像 "bitcoin getinfo" 这样的命令会失败。服务器面对行为正确的客户端时仍然工作正常。
可以在 Base64Encode 函数末尾从 result 中移除换行符（也许还有 ' '）来解决这个问题：
代码：
result.erase(std::remove(result.begin(), result.end(), ' '), result.end());
result.erase(std::remove(result.begin(), result.end(), ' '), result.end());+1，给你加一分，因为你的密码长到足以发现这个漏洞。
已作为修订版 110 上传到 SVN。
英文原文
展开英文原文
Quote from: lachesis on July 25, 2010, 07:52:35 PM
I found what appears to be a bug: with a long enough username and password combination, the base64 encoder in bitcoind produces authorization headers that look like this:
Code:
... Authorization: Basic YWJiYWJiYWFiYmE6aGVsbG93b3JsZGhlbGxvd29ybGRoZWxsb3dvcmxkaGVsbG93 b3JsZGhlbGxvd29ybGRoZWxsb3dvcmxk
It inserts a newline every 64 characters, which obviously breaks the Authorization header, so commands like "bitcoin getinfo" fail. The server still works fine with properly behaving clients.
This can be solved by removing the newlines (and maybe ' 's) from result at the end of the Base64Encode function:
Code:
result.erase(std::remove(result.begin(), result.end(), ' '), result.end()); result.erase(std::remove(result.begin(), result.end(), ' '), result.end());
+1 to you for having such a long password that you found this bug.
Uploaded to SVN as rev 110.