about summary refs log tree commit diff
path: root/urls.go
diff options
context:
space:
mode:
authorVincent Ambo <tazjin@gmail.com>2017-02-13T08·55+0100
committerVincent Ambo <tazjin@gmail.com>2017-02-13T08·55+0100
commit6dcb0f4b2bddc583212995397d6c6e1ec14adc58 (patch)
tree2f52e57fd1f64a36bb21dc5c56581e9a1c649e42 /urls.go
parent7824e0e7e34a4b5245f817fb70da53d4bcd707c7 (diff)
fix urls: Escape values in URLs
For usernames and passwords containing special characters the URL parameters
must be escaped.

Because the entire URI is just query parameters I've opted for using net/url.Values
for the entire URI.

Fixes #1
Diffstat (limited to 'urls.go')
-rw-r--r--urls.go30
1 files changed, 24 insertions, 6 deletions
diff --git a/urls.go b/urls.go
index a1fd825f578c..37f65e0faef4 100644
--- a/urls.go
+++ b/urls.go
@@ -1,19 +1,37 @@
 package main
 
-import "fmt"
+import (
+	"fmt"
+	"net/url"
+	"strconv"
+)
 
 const urlFormat string = "https://%s%s"
-const triggerChallengeUri = "/?action=sslvpn_logon&fw_username=%s&fw_password=%s&style=fw_logon_progress.xsl&fw_logon_type=logon&fw_domain=Firebox-DB"
-const responseUri = "/?action=sslvpn_logon&style=fw_logon_progress.xsl&fw_logon_type=response&response=%s&fw_logon_id=%d"
+const uriFormat = "/?%s"
 
 func templateChallengeTriggerUri(username *string, password *string) string {
-	return fmt.Sprintf(triggerChallengeUri, *username, *password)
+	v := url.Values{}
+	v.Set("action", "sslvpn_logon")
+	v.Set("style", "fw_logon_progress.xsl")
+	v.Set("fw_logon_type", "logon")
+	v.Set("fw_domain", "Firebox-DB")
+	v.Set("fw_username", *username)
+	v.Set("fw_password", *password)
+
+	return fmt.Sprintf(uriFormat, v.Encode())
 }
 
 func templateResponseUri(logonId int, token *string) string {
-	return fmt.Sprintf(responseUri, *token, logonId)
+	v := url.Values{}
+	v.Set("action", "sslvpn_logon")
+	v.Set("style", "fw_logon_progress.xsl")
+	v.Set("fw_logon_type", "response")
+	v.Set("response", *token)
+	v.Set("fw_logon_id", strconv.Itoa(logonId))
+
+	return fmt.Sprintf(uriFormat, v.Encode())
 }
 
 func templateUrl(baseUrl *string, uri string) string {
-	return fmt.Sprintf("https://%s%s", *baseUrl, uri)
+	return fmt.Sprintf(urlFormat, *baseUrl, uri)
 }