{"action":"created","issue":{"url":"https://api.github.com/repos/ImmobilienScout24/afp-cli/issues/44","labels_url":"https://api.github.com/repos/ImmobilienScout24/afp-cli/issues/44/labels{/name}","comments_url":"https://api.github.com/repos/ImmobilienScout24/afp-cli/issues/44/comments","events_url":"https://api.github.com/repos/ImmobilienScout24/afp-cli/issues/44/events","html_url":"https://github.com/ImmobilienScout24/afp-cli/issues/44","id":127480600,"number":44,"title":"Handle hash in role name (?)","user":{"login":"mriehl","id":1955590,"avatar_url":"https://avatars.githubusercontent.com/u/1955590?v=3","gravatar_id":"","url":"https://api.github.com/users/mriehl","html_url":"https://github.com/mriehl","followers_url":"https://api.github.com/users/mriehl/followers","following_url":"https://api.github.com/users/mriehl/following{/other_user}","gists_url":"https://api.github.com/users/mriehl/gists{/gist_id}","starred_url":"https://api.github.com/users/mriehl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mriehl/subscriptions","organizations_url":"https://api.github.com/users/mriehl/orgs","repos_url":"https://api.github.com/users/mriehl/repos","events_url":"https://api.github.com/users/mriehl/events{/privacy}","received_events_url":"https://api.github.com/users/mriehl/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-01-19T16:11:27Z","updated_at":"2016-01-26T09:54:24Z","closed_at":null,"body":"I don't know if there is a use case for this (I don't have one) but afp-cli seems to truncate the role when it encounters a hash.\r\n\r\n```bash\r\n» afpv2 show account-name role-\\#name\r\nPassword for mriehl: \r\nFailed to get credentials from AWS: API call to AWS (https://afp.invalid/afp-api/latest//account/account-name/role-#name) failed: User 'mriehl' may not access role 'role-' in account 'account-name'\r\n```\r\n\r\nThis is probably due to the hash becoming an anchor. It also allows for things like URL traversal (a malicious role name could make you log in to another account) so I think the user set parameters should be transmitted over json, not URL."},"comment":{"url":"https://api.github.com/repos/ImmobilienScout24/afp-cli/issues/comments/174934311","html_url":"https://github.com/ImmobilienScout24/afp-cli/issues/44#issuecomment-174934311","issue_url":"https://api.github.com/repos/ImmobilienScout24/afp-cli/issues/44","id":174934311,"user":{"login":"schlomo","id":101384,"avatar_url":"https://avatars.githubusercontent.com/u/101384?v=3","gravatar_id":"","url":"https://api.github.com/users/schlomo","html_url":"https://github.com/schlomo","followers_url":"https://api.github.com/users/schlomo/followers","following_url":"https://api.github.com/users/schlomo/following{/other_user}","gists_url":"https://api.github.com/users/schlomo/gists{/gist_id}","starred_url":"https://api.github.com/users/schlomo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/schlomo/subscriptions","organizations_url":"https://api.github.com/users/schlomo/orgs","repos_url":"https://api.github.com/users/schlomo/repos","events_url":"https://api.github.com/users/schlomo/events{/privacy}","received_events_url":"https://api.github.com/users/schlomo/received_events","type":"User","site_admin":false},"created_at":"2016-01-26T09:54:24Z","updated_at":"2016-01-26T09:54:24Z","body":"I very much hope that the security checks in AFP go by the user groups (@tvollmer-at-is24, @snordhausen  can you tell ?)."}}