Bitcointalk · JSON-RPC password

中本聪,2010 年 7 月 25 日

SN-1458 已核对来源,附原文与上下文。

阅读语言
中文译文

我发现了一个疑似 bug:当用户名和密码的组合够长时,bitcoind 的 base64 编码器生成的授权头看起来是这样的:

...
Authorization: Basic YWJiYWJiYWFiYmE6aGVsbG93b3JsZGhlbGxvd29ybGRoZWxsb3dvcmxkaGVsbG93
b3JsZGhlbGxvd29ybGRoZWxsb3dvcmxk

它每 64 个字符插入一个换行,这显然会破坏 Authorization 头,于是 "bitcoin getinfo" 这类命令失败。行为规范的客户端连服务器仍然一切正常。

解决办法是在 Base64Encode 函数末尾把 result 里的换行(也许还有 ' ')去掉:

result.erase(std::remove(result.begin(), result.end(), '
'), result.end());
result.erase(std::remove(result.begin(), result.end(), '
'), result.end());

给你 +1,密码长到能发现这个 bug。

已传到 SVN,rev 110。

ORIGINAL · 英文原文
I found what appears to be a bug: with a long enough username and password combination, the base64 encoder in bitcoind produces authorization headers that look like this:
Code:
...
Authorization: Basic YWJiYWJiYWFiYmE6aGVsbG93b3JsZGhlbGxvd29ybGRoZWxsb3dvcmxkaGVsbG93
b3JsZGhlbGxvd29ybGRoZWxsb3dvcmxk
It inserts a newline every 64 characters, which obviously breaks the Authorization header, so commands like "bitcoin getinfo" fail. The server still works fine with properly behaving clients.

This can be solved by removing the newlines (and maybe ' 's) from result at the end of the Base64Encode function:
Code:
result.erase(std::remove(result.begin(), result.end(), ' '), result.end());
result.erase(std::remove(result.begin(), result.end(), ' '), result.end());
+1 to you for having such a long password that you found this bug.

Uploaded to SVN as rev 110.
来源
Bitcointalk 原始链接 ↗ 记录编号 SN-1458