{"action":"created","issue":{"url":"https://api.github.com/repos/Arachni/arachni/issues/679","repository_url":"https://api.github.com/repos/Arachni/arachni","labels_url":"https://api.github.com/repos/Arachni/arachni/issues/679/labels{/name}","comments_url":"https://api.github.com/repos/Arachni/arachni/issues/679/comments","events_url":"https://api.github.com/repos/Arachni/arachni/issues/679/events","html_url":"https://github.com/Arachni/arachni/pull/679","id":136696771,"number":679,"title":"Fix user-supplied email addresses containing '+' character.","user":{"login":"seanhandley","id":98526,"avatar_url":"https://avatars.githubusercontent.com/u/98526?v=3","gravatar_id":"","url":"https://api.github.com/users/seanhandley","html_url":"https://github.com/seanhandley","followers_url":"https://api.github.com/users/seanhandley/followers","following_url":"https://api.github.com/users/seanhandley/following{/other_user}","gists_url":"https://api.github.com/users/seanhandley/gists{/gist_id}","starred_url":"https://api.github.com/users/seanhandley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seanhandley/subscriptions","organizations_url":"https://api.github.com/users/seanhandley/orgs","repos_url":"https://api.github.com/users/seanhandley/repos","events_url":"https://api.github.com/users/seanhandley/events{/privacy}","received_events_url":"https://api.github.com/users/seanhandley/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-26T13:27:41Z","updated_at":"2016-02-29T17:33:01Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/Arachni/arachni/pulls/679","html_url":"https://github.com/Arachni/arachni/pull/679","diff_url":"https://github.com/Arachni/arachni/pull/679.diff","patch_url":"https://github.com/Arachni/arachni/pull/679.patch"},"body":"Autologin plugin fails if the user's email address (quite validly) contains a \"+\".\r\n\r\nUsing GMail labels of the form `my.user+label@gmail.com` I found a scenario where Arachni can't log into the app. On checking the server logs, I saw it was submitting email addresses of the form\r\n\r\n`my.user label@gmail.com`\r\n\r\nresulting in the server to return `422 Unprocessable Entity`\r\n\r\nThis is down to the way the form parameters are sanitised in https://github.com/Arachni/arachni/blob/master/lib/arachni/element/form.rb#L423\r\n\r\ne.g.\r\n\r\n```ruby\r\nURI.decode_www_form_component \"sean.handley+testing@gmail.com\"\r\n=> \"sean.handley testing@gmail.com\"\r\nURI.decode_www_form_component \"user[email]=sean.handley+testing@gmail.com\"\r\n=> \"user[email]=sean.handley testing@gmail.com\"\r\nURI.decode \"user[email]=sean.handley+testing@gmail.com\"\r\n=> \"user[email]=sean.handley+testing@gmail.com\"\r\nURI.decode_www_form_component \"user%5Bemail%5D=sean.handley%2Barachni%40datacentred.co.uk\"\r\n=> \"user[email]=sean.handley+arachni@datacentred.co.uk\"\r\nURI.decode \"user%5Bemail%5D=sean.handley%2Barachni%40datacentred.co.uk\"\r\n=> \"user[email]=sean.handley+arachni@datacentred.co.uk\"\r\n```\r\n\r\nAn alternative approach is to instruct the user in the plugin documentation to enter the string in an encoded form at https://github.com/arachni/arachni/blob/master/components/plugins/autologin.rb#L110"},"comment":{"url":"https://api.github.com/repos/Arachni/arachni/issues/comments/190303113","html_url":"https://github.com/Arachni/arachni/pull/679#issuecomment-190303113","issue_url":"https://api.github.com/repos/Arachni/arachni/issues/679","id":190303113,"user":{"login":"Zapotek","id":375743,"avatar_url":"https://avatars.githubusercontent.com/u/375743?v=3","gravatar_id":"","url":"https://api.github.com/users/Zapotek","html_url":"https://github.com/Zapotek","followers_url":"https://api.github.com/users/Zapotek/followers","following_url":"https://api.github.com/users/Zapotek/following{/other_user}","gists_url":"https://api.github.com/users/Zapotek/gists{/gist_id}","starred_url":"https://api.github.com/users/Zapotek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Zapotek/subscriptions","organizations_url":"https://api.github.com/users/Zapotek/orgs","repos_url":"https://api.github.com/users/Zapotek/repos","events_url":"https://api.github.com/users/Zapotek/events{/privacy}","received_events_url":"https://api.github.com/users/Zapotek/received_events","type":"User","site_admin":false},"created_at":"2016-02-29T17:33:01Z","updated_at":"2016-02-29T17:33:01Z","body":"I'll need to do extensive tests for changes in the element encoding as it can cause problems elsewhere.\r\nThanks for the PR btw."}}