fix: decode percent-encoded username/password before building Basic Auth header (#6716)

URLs with percent-encoded characters in credentials (e.g. %40 for @) were
being double-encoded after Url::parse() + as_str() serialization, causing
the constructed Basic Auth header to contain the wrong credentials and
resulting in 401 Unauthorized errors.
This commit is contained in:
git-sac 2026-04-03 19:29:38 +08:00 committed by GitHub
parent fa4557337b
commit 7b7dc79c74
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -155,7 +155,13 @@ impl NetworkManager {
if !parsed.username().is_empty()
&& let Some(pass) = parsed.password()
{
let auth_str = format!("{}:{}", parsed.username(), pass);
let username = percent_encoding::percent_decode_str(parsed.username())
.decode_utf8_lossy()
.into_owned();
let password = percent_encoding::percent_decode_str(pass)
.decode_utf8_lossy()
.into_owned();
let auth_str = format!("{}:{}", username, password);
let encoded = general_purpose::STANDARD.encode(auth_str);
extra_headers.insert("Authorization", HeaderValue::from_str(&format!("Basic {}", encoded))?);
}