Skip to content

fix(fmt): keep a ':' in a Naive password through export and import - #10526

Merged
2dust merged 1 commit into
2dust:masterfrom
b84330808:fix-naive-password-colon
Nov 5, 2026
Merged

2dust merged 1 commit into
2dust:masterfrom
b84330808:fix-naive-password-colon

Conversation

@b84330808

Copy link
Copy Markdown
Contributor

NaiveFmt.ToUri percent-encodes the user info, so a password-only Naive profile with the password a:b is shared as

naive+https://a%3Ab@host:443

NaiveFmt.Resolve decodes the user info first and then looks for the : separator, so importing that link gives Username a and Password b. The same happens to a username or password with a : when both are set (us%3Aer:pa%3Ass comes back as us / er:pa:ss).

This splits the raw user info at the first : and decodes each part afterwards. Links with a literal : (what:hap:pened) split the same way as before.

Tests: new NaiveFmtUserInfoTests (export/import round trip for password-only profiles with : in different places, username and password both with :, and a few hand-written links). Without the change 6 of the 10 fail; with it all 10 pass, and the full ServiceLib.Tests suite passes (186/186) on Windows, .NET SDK 10.0.403.

NaiveFmt.ToUri percent-encodes the username and password, so a
password-only profile with the password a:b is exported as
naive+https://a%3Ab@host. Resolve decoded the user info before
looking for the ':' separator and imported it as username "a",
password "b". Split the raw user info first and decode each part.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@2dust
2dust merged commit 2010477 into 2dust:master Nov 5, 2026
10 of 11 checks passed
patterniha added a commit to patterniha/PattN that referenced this pull request Nov 11, 2026
Brings in 2dust/v2rayN up to e3457fa (still 7.25.6):
- Native AOT (2dust#10295, 2dust#10513): JSON through a source-generated
  context, trimming roots, and AOT zips of the Windows desktop, Linux
  and macOS builds; ReactiveUI 26 (2dust#10249) and ProDataGrid (2dust#10347);
- a pre-resolver per subscription (2dust#10220), MASQUE WARP (2dust#10498), the
  XDRIVE transport (2dust#10546), sing-box TUN dns_mode (2dust#10336) and an AUTO
  bind interface (2dust#10519);
- the download refactor with Downloader 6 (2dust#10534), subscription
  profiles kept on a failed import (2dust#10429), repeated test results
  kept (2dust#10466), share-link fixes (2dust#10504, 2dust#10505, 2dust#10520, 2dust#10526),
  udphop (2dust#10550), REALITY fragments (2dust#10428), and the WebAPI's
  restart deadline (2dust#10516) and macOS instance lock (2dust#10454);
- Linux packages cross-built for x64, arm64, riscv64, ppc64le and
  loong64 in one job, plus x86 packages (2dust#10487, 2dust#10537), and a daily
  certificate update workflow (2dust#10497).

Where upstream changed code PattN had changed:
- no IPv6 FakeIP setting (2dust#10464): PattN writes no fakedns block, so
  Xray-core uses its default IPv4 and IPv6 pools, and sing-box gets an
  IPv6 range on its own; FakeIPUtils and its tests go;
- 2dust#10485's DNS change is not taken: PattN asks each direct group's
  servers in turn and ends the query on the last;
- the TUN inbound copies the inbound's sniffing (2dust#10460) without
  forcing routeOnly;
- MASQUE: upstream's editor and import, which no longer clear or lock
  the TLS options: the fork core speaks HTTP/2 over TLS when the ALPN
  has h2 but not h3, so they apply there;
- the WebAPI restart: upstream's polling fix (2dust#10516) replaces PattN's
  own wait.

Adapted to the AOT JSON and the download refactor: Aether's DNS, the
share-link JSON options, the outbound tag check and the Psiphon test
fixtures go through the source-generated context; the Aether test only
says whether to measure speed, and its IP lookup uses a download
service on the tunnel's proxy; the rule-set 404 skip moves into the new
download helper.

Release workflows and Linux packaging scripts take upstream's layout
with PattN's names and bundles: every Linux architecture builds on each
release (exotic_arch is gone; patterniha/Aether has builds for x64 and
arm64 only), the deb packages keep the cores' execute bits (2dust#10335),
which 2dust#10537's rewrite dropped, and the certificate workflow runs only
upstream.

Conflicts:
- resx: both sets of strings.
- SubEditWindow: upstream's pre-resolver row among PattN's rows.
- AddServerViewModelTests: upstream's; PattN's preset tests move to
  AddServerViewModelPresetTests.
- CoreConfigV2rayIPNetworkTests: without upstream's fakedns pool test.
- README: PattN's.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants