Disallow control characters in http basic auth username or password

index.html

@@ -393,9 +393,11 @@
 
                 <div class="input_option">
                     <div class="label">{lang.option_httpAuthPassword} <a href="#" class="help_icon" aria-label="{lang.help}" onclick="helpInfo(event, 'httpAuthPassword', 'option')"><i class="material-icons" aria-hidden="true">help_outline</i></a></div>
-                    <input type="text" id="httpAuthPassword" placeholder="" aria-label="{lang.option_httpAuthPassword}">
+                    <input type="text" id="httpAuthPassword" placeholder="" oninput="httpAuthPasswordChange();reevaluateSectionHeights();" aria-label="{lang.option_httpAuthPassword}">
                 </div>
 
+                <div class="input_error">{lang.httpAuthPassword_invalid}</div>
+
                 <div class="input_option">
                     <div class="label">{lang.option_ipThrottling} <a href="#" class="help_icon" aria-label="{lang.help}" onclick="helpInfo(event, 'ipThrottling', 'option')"><i class="material-icons" aria-hidden="true">help_outline</i></a></div>
                     <input type="number" id="ipThrottling" placeholder="10" step="1" oninput="ipLimitChange();reevaluateSectionHeights()" style="width: 100px;" aria-label="{lang.option_ipThrottling}">

lang.js

@@ -118,8 +118,9 @@ lang = {
         "option_httpAuth": "Enable HTTP Basic authentication",
         "option_httpAuth_description": "Require authentication using the HTTP Basic authentication protocol. Specify a username and password in the HTTP Basic auth username and HTTP Basic auth password options. If either the username or password option is missing or invalid, the web server will become inaccessible.",
         "option_httpAuthUsername": "HTTP Basic auth username",
-        "option_httpAuthUsername_description": "Username for HTTP Basic authentication. Cannot contain a colon (<code>:</code>) character.",
-        "httpAuthUsername_invalid": "Username cannot contain <code>:</code>",
+        "option_httpAuthUsername_description": "Username for HTTP Basic authentication. Cannot contain a colon (<code>:</code>) character or control characters.",
+        "httpAuthUsername_invalid": "Username cannot contain <code>:</code> or control characters",
+        "httpAuthPassword_invalid": "Password cannot contain control characters",
         "option_httpAuthPassword": "HTTP Basic auth password",
         "option_httpAuthPassword_description": "Password for HTTP Basic authentication. Stored in plain text.",
         "option_ipThrottling": "Maximum connections per IP address",
@@ -257,6 +258,7 @@ lang = {
         "option_httpAuthUsername": "Имя пользователя HTTP Basic авторизации",
         "option_httpAuthUsername_description": "Имя пользователя для HTTP Basic авторизации. Не может содержать двоеточия (<code>:</code>).",
         "httpAuthUsername_invalid": "Имя пользователя не может содержать <code>:</code>",
+        "httpAuthPassword_invalid": "Password cannot contain control characters",
         "option_httpAuthPassword": "Пароль HTTP Basic авторизации",
         "option_httpAuthPassword_description": "Пароль для HTTP Basic авторизации. Хранится в чистом виде.",
         "option_ipThrottling": "Предел соединений по IP адресу",
@@ -394,6 +396,7 @@ lang = {
         "option_httpAuthUsername": "HTTP基本身份验证用户名",
         "option_httpAuthUsername_description": "HTTP基本身份验证的用户名。不能包含冒号(<code>:</code>)字符。",
         "httpAuthUsername_invalid": "用户名不能包含 <code>:</code>",
+        "httpAuthPassword_invalid": "Password cannot contain control characters",
         "option_httpAuthPassword": "HTTP基本身份验证密码",
         "option_httpAuthPassword_description": "HTTP基本身份验证的密码。以纯文本形式存储。",
         "option_ipThrottling": "每个IP地址的最大连接数",
@@ -531,6 +534,7 @@ lang = {
         "option_httpAuthUsername": "ベーシック認証ユーザー名",
         "option_httpAuthUsername_description": "ベーシック認証のユーザー名。<code>:</code>を含んでいてはいけません。",
         "httpAuthUsername_invalid": "ユーザー名に<code>:</code>を含めることはできません。",
+        "httpAuthPassword_invalid": "Password cannot contain control characters",
         "option_httpAuthPassword": "ベーシック認証パスワード",
         "option_httpAuthPassword_description": "ベーシック認証のパスワード。平文で保存されます。",
         "option_ipThrottling": "IPアドレスごとの最大接続数",

main.js

@@ -407,6 +407,7 @@ function addServer(editindex) {
         document.querySelector("#httpAuthUsername").value = config.servers[editindex].httpAuthUsername || "";
         httpAuthUsernameChange();
         document.querySelector("#httpAuthPassword").value = config.servers[editindex].httpAuthPassword || "";
+        httpAuthPasswordChange();
         document.querySelector("#ipThrottling").value = config.servers[editindex].ipThrottling || 10;
         ipLimitChange();
 
@@ -457,6 +458,7 @@ function addServer(editindex) {
         document.querySelector("#httpAuthUsername").value = "";
         httpAuthUsernameChange();
         document.querySelector("#httpAuthPassword").value = "";
+        httpAuthPasswordChange();
         document.querySelector("#ipThrottling").value = 10;
         ipLimitChange();
 
@@ -505,6 +507,17 @@ function submitAddServer() {
         return;
     }
 
+    if (!httpAuthPasswordValid()) {
+        document.querySelector("#httpAuthPassword").parentElement.nextElementSibling.style.display = "block";
+        if (!document.querySelector("#security_section").classList.contains("section_visible")) {
+            toggleSection(document.querySelector("#security_section"))
+            setTimeout(()=>document.querySelector("#httpAuthPassword").previousElementSibling.scrollIntoView({behavior: "smooth"}), 210);
+        } else {
+            document.querySelector("#httpAuthPassword").previousElementSibling.scrollIntoView({behavior: "smooth"});
+        }
+        return;
+    }
+
     if (!ipLimitValid()) {
         document.querySelector("#ipThrottling").parentElement.nextElementSibling.style.display = "block";
         if (!document.querySelector("#security_section").classList.contains("section_visible")) {
@@ -704,8 +717,13 @@ function ipLimitChange() {
     }
 }
 
+function stringContainsControlCharacters(str) {
+    const controlCharacterPattern = /[\x00-\x1F\x7F]/;
+    return controlCharacterPattern.test(str);
+  }
+
 function httpAuthUsernameValid() {
-    return document.querySelector("#httpAuthUsername").value.indexOf(":") === -1;
+    return document.querySelector("#httpAuthUsername").value.indexOf(":") === -1 && !stringContainsControlCharacters(document.querySelector("#httpAuthUsername").value);
 }
 
 function httpAuthUsernameChange() {
@@ -716,6 +734,18 @@ function httpAuthUsernameChange() {
     }
 }
 
+function httpAuthPasswordValid() {
+    return !stringContainsControlCharacters(document.querySelector("#httpAuthPassword").value);
+}
+
+function httpAuthPasswordChange() {
+    if (httpAuthPasswordValid()) {
+        document.querySelector("#httpAuthPassword").parentElement.nextElementSibling.style.display = "none";
+    } else {
+        document.querySelector("#httpAuthPassword").parentElement.nextElementSibling.style.display = "block";
+    }
+}
+
 function updateCurrentPath() {
     if (current_path) {
         document.querySelector("#path > div > span").innerText = current_path;

website/src/docs/options.md

@@ -261,15 +261,15 @@ Require authentication using the HTTP Basic authentication protocol. Specify a u
 - Type: string
 - Default: -
 
-Username for HTTP Basic authentication. Cannot contain a colon (`:`) character.
+Username for HTTP Basic authentication. Cannot contain a colon (`:`) character or control characters.
 
 ### HTTP Basic auth password
 
 - Name: `httpAuthPassword`
 - Type: string
 - Default: -
 
-Password for HTTP Basic authentication. Stored in plain text.
+Password for HTTP Basic authentication. Stored in plain text. Cannot contain control characters.
 
 ### Maximum connections per IP address