Raise ValueError if BasicAuth login has a ":" (#1307)

CHANGES.rst

@@ -231,3 +231,5 @@ CHANGES
   domains (BACKWARD INCOMPATIBLE) #1125
 
 - Support binary Content-Transfer-Encoding #1169
+
+- Raise ValueError if BasicAuth login has a ":"  

CONTRIBUTORS.txt

@@ -138,3 +138,4 @@ Yusuke Tsutsumi
 Семён Марьясин
 Pau Freixes
 Alexey Firsov
+Vikas Kawadia

aiohttp/helpers.py

@@ -47,6 +47,10 @@ def __new__(cls, login, password='', encoding='latin1'):
         if password is None:
             raise ValueError('None is not allowed as password value')
 
+        if ':' in login:
+            raise ValueError(
+                'A ":" is not allowed in login (RFC 1945#section-11.1)')
+
         return super().__new__(cls, login, password, encoding)
 
     @classmethod

tests/test_helpers.py

@@ -60,6 +60,11 @@ def test_basic_auth2():
         helpers.BasicAuth('nkim', None)
 
 
+def test_basic_with_auth_colon_in_login():
+    with pytest.raises(ValueError):
+        helpers.BasicAuth('nkim:1', 'pwd')
+
+
 def test_basic_auth3():
     auth = helpers.BasicAuth('nkim')
     assert auth.login == 'nkim'