Question

I am working on an app that relies on the XML API. The app wouldn't authenticate. I noticed that the URL I was constructing to send for authentication purposes was coming back NULL from the library I was using to send the request--not the response, but the URL itself.

As it turns out, my password had a \r sequence (2 UTF-8 characters) in it. (Yes, I realize this is odd. It's a hash. However, the regular FogBugz UI has never complained about it.) That meant that my GET request, with the username and password in the query string, was invalid ('\' is not a valid URI character).

I switched to using POST, which caused the app to not crash, at least, but I got back a valid error response (something along the lines of "username and password do not match").

I'm pretty sure I'm doing the POST correctly, as I changed my password to something mundane and managed to get an auth token back. Is it possible that somewhere in the guts of the auth process, FB is comparing an escaped string against a non-escaped string?

Answer 1

Well, if I'm not mistaken, an \r sequence is not valid in the XML specification as a character. Parsers are required to transform \r into \n. http://www.w3.org/TR/REC-xml/#sec-line-ends

As a guess, since the XML API is that, XML, I'm assuming that the parser used in fogbugz ad-hears to the specification.

One quick test may be to try loading it with XDocument.Parse. It holds to the rules more tightly than some of the other MS XML parsers/readers.