The new SOCKS4 >255-byte user-name rejection (curl test 729, socks4_req_add_user in curl's lib/socks.c) measures the user-id string as urlx received it. curl percent-decodes proxy credentials before measuring and before putting them on the wire; urlx appears to pass the encoded form through, so:
- a percent-encoded name whose decoded length is <= 255 could be falsely rejected;
- the wire bytes differ from curl for any encoded character.
Not reachable by the current test suite (test 729 uses 1015 plain 'a's). Fix: percent-decode proxy credentials before the length check and wire write, for both SOCKS4/4a and SOCKS5.
The new SOCKS4 >255-byte user-name rejection (curl test 729, socks4_req_add_user in curl's lib/socks.c) measures the user-id string as urlx received it. curl percent-decodes proxy credentials before measuring and before putting them on the wire; urlx appears to pass the encoded form through, so:
Not reachable by the current test suite (test 729 uses 1015 plain 'a's). Fix: percent-decode proxy credentials before the length check and wire write, for both SOCKS4/4a and SOCKS5.