From 8d1096c3d640371219cf7103d35470c5a4ed3a08 Mon Sep 17 00:00:00 2001
From: Lew Gordon <lew.gordon@genesys.com>
Date: Thu, 8 Jul 2021 11:43:26 -0400
Subject: [PATCH] http: decodes url.username and url.password for authorization
 header

This change properly decodes the url.username and url.password for
the authorization header constructed from the URL object for
http(s) requests.

Fixes: https://github.com/nodejs/node/issues/31439
---
 doc/api/http.md                         |  4 +++
 doc/api/https.md                        |  4 +++
 lib/internal/url.js                     |  2 +-
 test/parallel/test-http-decoded-auth.js | 33 +++++++++++++++++++++++++
 4 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 test/parallel/test-http-decoded-auth.js

diff --git a/doc/api/http.md b/doc/api/http.md
index 84e98f5ff79d1e..0555b8dd4227f0 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -2804,6 +2804,10 @@ This can be overridden for servers and client requests by passing the
 <!-- YAML
 added: v0.3.6
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/39310
+    description: When using a `URL` object parsed username and
+                 password will now be properly URI decoded.
   - version:
       - v15.3.0
       - v14.17.0
diff --git a/doc/api/https.md b/doc/api/https.md
index f4c1f0487a779a..f74f48c9cb54ae 100644
--- a/doc/api/https.md
+++ b/doc/api/https.md
@@ -251,6 +251,10 @@ Global instance of [`https.Agent`][] for all HTTPS client requests.
 <!-- YAML
 added: v0.3.6
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/39310
+    description: When using a `URL` object parsed username
+                 and password will now be properly URI decoded.
   - version:
     - v14.1.0
     - v13.14.0
diff --git a/lib/internal/url.js b/lib/internal/url.js
index 7d2bed80028d30..0749e07d6e7677 100644
--- a/lib/internal/url.js
+++ b/lib/internal/url.js
@@ -1303,7 +1303,7 @@ function urlToHttpOptions(url) {
     options.port = Number(url.port);
   }
   if (url.username || url.password) {
-    options.auth = `${url.username}:${url.password}`;
+    options.auth = `${decodeURIComponent(url.username)}:${decodeURIComponent(url.password)}`;
   }
   return options;
 }
diff --git a/test/parallel/test-http-decoded-auth.js b/test/parallel/test-http-decoded-auth.js
new file mode 100644
index 00000000000000..984e3978003fc7
--- /dev/null
+++ b/test/parallel/test-http-decoded-auth.js
@@ -0,0 +1,33 @@
+'use strict';
+require('../common');
+const assert = require('assert');
+const http = require('http');
+
+const testCases = [
+    {username: 'test@test"', password: '123456^', expected: 'dGVzdEB0ZXN0IjoxMjM0NTZe'},
+    {username: 'test%40test', password: '123456', expected: 'dGVzdEB0ZXN0OjEyMzQ1Ng=='},
+    {username: 'not%3Agood', password: 'god', expected: 'bm90Omdvb2Q6Z29k'},
+    {username: 'not%22good', password: 'g%5Eod', expected: 'bm90Imdvb2Q6Z15vZA=='},
+    {username: 'test1234::::', password: 'mypass', expected: 'dGVzdDEyMzQ6Ojo6Om15cGFzcw=='}
+]
+
+for (const testCase of testCases) {
+    function check(request) {
+        // The correct authorization header is be passed
+        assert.strictEqual(request.headers.authorization, `Basic ${testCase.expected}`);
+    }
+
+    const server = http.createServer(function(request, response) {
+        // Run the check function
+        check(request);
+        response.writeHead(200, {});
+        response.end('ok');
+        server.close();
+    });
+
+    server.listen(0, function() {
+        // make the request
+        const url = new URL(`http://${testCase.username}:${testCase.password}@localhost:${this.address().port}`);
+        http.request(url).end();
+    });
+}
\ No newline at end of file