Basic Authentication fails with a password containing ":" character

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.X, 7.1.X, Master
• Fix Version/s: 7.0.0 DXP FP71, 7.0.10.11 DXP SP11, 7.0.X, 7.1.10 DXP FP6, 7.1.10.2 SP2, 7.1.3 CE GA4, 7.1.X, Master
• Component/s: Application Security, Application Security > Auth Verifiers
• Labels:
  • backend_test
  • ee-ts
  • liferay-dxp-70-sp11
  • liferay-dxp-71-sp2
  • liferay-fixpack-de-71-7010
  • liferay-fixpack-dxp-6-7110
• Branch Version/s:
  7.1.x, 7.0.x
• Backported to Branch:
  Committed
• Story Points: 3
• Fix Priority: 4
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/66013
• Bug Type: Security

In the attachments there's a Web Service Client, that calls 7.1 Portlet_DL_DLAppService.getFIleEntriesCount() and tested it with DXP 7.1.
The sample source code is attached, the following line:
System.out.println(service.getFileEntriesCount(20126, 0));

In PWWSTest.java should be changed, to replace 20126 with the Guest group's groupId.

The service connects to localhost over port 8080

1. Start a portal
2. Make sure the login works with screenname and password (portal authentication should be changed to screenName)
3. When portal is up and running run the web service client

Expected behaviour: it will print the numbers of FileEntries for the guest group will be 0 by default.

1. Now login to the portal and change test's password to e.g.: te:st
2. Modify DLAppServiceSoapServiceLocator to change this line:
   private java.lang.String Portlet_DL_DLAppService_address = "http://test:[email protected]:8080/api/axis/Portlet_DL_DLAppService";
3. and have your password specified instead of the second "test"
   #Run the PWWSTest application again

Result: you should see everything is ok, but apparently you can observe authentication failure message