[ruby-dev:28564] Re: Proxy authentication patches for open-uri and rubygems

In article <[e-mail]>,
  "Tadashi Kadowaki" <[e-mail]> writes:

> 一つ目は、環境変数http_proxyが"http://user:[e-mail]:8080"となっている
> 場合にうまく認証ができていない件に対するパッチです。CVSにある1.44に対する差分です。

環境変数は他のユーザから参照できるためパスワードの保存には不
適切です。そのため、このパッチは受け入れられません。

なお、RFC 3986 では user:password を userinfo に入れるのは
deprecated とされています。

   Use of the format "user:password" in the userinfo field is
   deprecated.  Applications should not render as clear text any data
   after the first colon (":") character found within a userinfo
   subcomponent unless the data after the colon is the empty string
   (indicating no password).  Applications may choose to ignore or
   reject such data when it is received as part of a reference and
   should reject the storage of such data in unencrypted form.  The
   passing of authentication information in clear text has proven to be
   a security risk in almost every case where it has been used.
-- 
[田中 哲][たなか あきら][Tanaka Akira]