Skip to content

Escape or URL encode paths where necessary#159

Merged
michael-o merged 1 commit intomasterfrom
premature-escaping
Mar 14, 2022
Merged

Escape or URL encode paths where necessary#159
michael-o merged 1 commit intomasterfrom
premature-escaping

Conversation

@michael-o
Copy link
Copy Markdown
Member

When running in non-MultiViews mode path passed from browser is prematurely
escaped for XML although it is still in use in PHP. This will result in two
issues:

  • Broken paths are processed in PHP
  • Data returned to users is broken or double escaped

This closes #155

When running in non-MultiViews mode path passed from browser is prematurely
escaped for XML although it is still in use in PHP. This will result in two
issues:

* Broken paths are processed in PHP
* Data returned to users is broken or double escaped

This closes #155
@michael-o michael-o force-pushed the premature-escaping branch from 7d5d4d0 to e329b8c Compare March 3, 2022 09:39
@michael-o michael-o changed the title Do not prematurely escape paths Escape or URL encode paths where necessary Mar 3, 2022
@michael-o michael-o requested a review from ams-tschoening March 3, 2022 09:39
@michael-o michael-o marked this pull request as ready for review March 3, 2022 09:39
$vars['rev'] = $rev;
$vars['peg'] = $peg;
$vars['path'] = escape($ppath);
$vars['path'] = str_replace('%2F', '/', rawurlencode($ppath));
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks confusing to me: I would have expected path to be a plain path, not an encoded URL. What's the reason for doing so? Is path always used in some URL-context? Wouldn't it be better to distinguish the plain path from an encoded URL using different variable names, something like urlPath or pathAsUrl or alike? Pretty much like safepath currently.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can explain that. If you look at the tempates: websvn:path is solely used iwth href attributes which require URI encoding. Paths which appear as text are prefixed with safe since they aren't usable in href attributes. Thhe code did not properly address this and assumed that files would be 7 bit ASCII only.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So how about renaming path to something mentioning it to be a URL instead? Too risky/too much work or simple global search&replace? safepath seems badly named as well and is more like a htmlPath.

Copy link
Copy Markdown
Member Author

@michael-o michael-o Mar 7, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with the second that safePath should have been htmlPath. I have just reused the given term.

As far as path is concerned, the name is too generic, I agree, but it can never be a URL because the base URL is provided through a var as well. Moreover, I would make the diff even bigger and affect all templates. I would consider this in a seoncd for for the sake of simplicity.

Copy link
Copy Markdown
Contributor

@ams-tschoening ams-tschoening left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I won't have the time to test this in detail, so let's end naming discussions and use what works for you.

@michael-o
Copy link
Copy Markdown
Member Author

I won't have the time to test this in detail, so let's end naming discussions and use what works for you.

I did testing with all templates and affected PHP files with multi views and non-MV, I hope I haven't miss anything. I will leave the reporter a few more days to test and then will merge.

@michael-o michael-o merged commit 088bd1b into master Mar 14, 2022
@michael-o michael-o deleted the premature-escaping branch March 14, 2022 08:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Doesn't work if there are apostrophes in the file name.

2 participants