CorrectAlias comments on Bug Report: URI Sanitization

Bug Report: URI Sanitization (sh.itjust.works)

submitted 1 month ago by Pomal@sh.itjust.works to c/summit@lemmy.world

22 comments fedilink hide all child comments

Morning Team,

Please see the thread found at this link, between myself and the OP:

https://sh.itjust.works/post/68082252

I’d like to request that the LinkResolver.ky file be updated so that URIs have their RFC-3986 well-defined Reserved Characters “percent-encoded” before being transferred to a buffer.

If you need an assist on dev for this, lmk :) I’m about since Gingerbread on developing for android, let alone kt but I have the spice😭

you are viewing a single comment's thread
view the rest of the comments

[–] CorrectAlias@piefed.blahaj.zone 2 points 3 weeks ago (14 children)

On my end, it's the same for the crosspost links. I do think this is likely an upstream Piefed bug (that may have been slightly fixed), as when I'd copy the urls a week or so ago, it would also have the @ in the URL. Now though, this seems to not be the case.

parent

hideshow 14 child comments

[–] Pomal@sh.itjust.works [S] 1 point 3 weeks ago (13 children)

@idunnololz@lemmy.world

:)

parent

hideshow 13 child comments

[–] idunnololz@lemmy.world 3 points 3 weeks ago* (12 children)

I think I misunderstood the bug. So the real bug is that the url shouldn't have an @? I tested in chrome/firefox and it works though so the url definitely seems to be valid.

I'd argue this is a bug on the other front ends for not supporting this url style.

parent

hideshow 12 child comments

[–] Pomal@sh.itjust.works [S] 1 point 2 weeks ago (11 children)

This is correct - the underlying linked url must be encoded. So the link that goes into the parenthesis’ ( ) .

Would you mind pointing me to an appropriate repo to delve?

parent

hideshow 11 child comments

[–] idunnololz@lemmy.world 1 point 1 day ago* (10 children)

Bleh this is more complex than I thought. I thought I could just use a library function to encode it but when I pass in the URL and encode it it just gives the same string back. Turns out '@' is a valid symbol for a query param and does not need to be encoded. I might have to say this the URL is valid and it's the website that is wrong.

I could do something hacky and just manually replace any @ with the encoded form though. It's not hard but I would prefer not to.

parent

hideshow 10 child comments

[–] Pomal@sh.itjust.works [S] 1 point 1 day ago (9 children)

Read the RFC dude, the @ symbol must be encoded lol. It sucks ass but it must be done. Last time I made a filter for special chars it was easiest to do a find on the index of the special chars, remove the char from the string array by index, and then inject the encoded value back into the array by index.

Cyberchef is a great resource for testing what right should fuzzily look like, you can also strip logic from them need be on capturing.

parent

hideshow 9 child comments

[–] idunnololz@lemmy.world 1 point 1 day ago* (last edited 1 day ago) (8 children)

Not sure if this is the right RFC but based on https://www.rfc-editor.org/rfc/rfc3986.html:

From 3.4. Query query = *( pchar / "/" / "?" )

From 3.3 pchar = unreserved / pct-encoded / sub-delims / ":" / "@"

Note that "@" is explicitly call out as not encoded.

Edit: Github is currently down but I am using https://github.com/1184893257/okhttp/blob/master/okhttp/src/main/java/com/squareup/okhttp/HttpUrl.java to encode the URL. If you think their encoding is wrong please open a ticket with them.

parent

hideshow 8 child comments

[–] Pomal@sh.itjust.works [S] 1 point 1 day ago (7 children)

2.2. Reserved Characters

URIs include components and subcomponents that are delimited by characters in the "reserved" set. These characters are called “reserved" because they may (or may not) be defined as delimiters by the generic syntax, by each scheme-specific syntax, or by the implementation-specific syntax of a URI's dereferencing algorithm. If data for a URI component would conflict with a reserved character's purpose as a delimiter, then the conflicting data must be percent-encoded before the URI is formed.

parent

hideshow 7 child comments

[–] idunnololz@lemmy.world 1 point 1 day ago* (last edited 1 day ago) (6 children)

I think you should open a ticket with okhttp.

If you need help, what you really want to open a ticket with is this:

static final String QUERY_COMPONENT_ENCODE_SET = " \"<>#&=";

You want to ask them to add "@" to this set.

parent

hideshow 6 child comments

[–] Pomal@sh.itjust.works [S] 1 point 1 day ago (5 children)

I think you should probanly stop supporting an App if you can’t untangle URL vs URI

parent

hideshow 5 child comments

[–] idunnololz@lemmy.world 1 point 1 day ago* (4 children)

I don't understand. I am pointing you to exactly where to request the change. I even gave you exactly where the problem is in the code. What more do you want from me?

Sorry. I forgot to include the line in the code: https://github.com/1184893257/okhttp/blob/master/okhttp/src/main/java/com/squareup/okhttp/HttpUrl.java#L266

parent

hideshow 4 child comments

[–] Pomal@sh.itjust.works [S] 1 point 1 day ago (3 children)

It’s a 10 year old library with little to no support and you’re fighting making your own code to handle the cruft. Truly get and take actual help on the project.

parent

hideshow 3 child comments

[–] idunnololz@lemmy.world 1 point 1 day ago (1 child)

Updated my comment. Please read.

parent

hideshow 1 child comment

[–] Pomal@sh.itjust.works [S] 1 point 1 day ago

I’m going to dive the lemmy-ui later this week. Like shouldn’t be getting processed like that. They’ll need to find a different method of linking communities across platforms

parent

[–] idunnololz@lemmy.world 1 point 1 day ago* (last edited 1 day ago)

Last human commit was 4 days ago and the last release was last month. I think it’s still active.

Edit: Wow I linked to the wrong repository. My bad. Github was experiencing an outage so I pulled the link from google. Here is the real repo: https://github.com/lysine-dev/okhttp

Edit 2: Github is still struggling but will try to get you the exact location in code once I can load the page.

Edit 3: Here is the updated location in code: https://github.com/lysine-dev/okhttp/blob/main/okhttp/src/commonJvmAndroid/kotlin/okhttp3/internal/url/-Url.kt#L30.

You can open a ticket there and explain the issue. They are still closing issues so they should be able to get to it.

Edit 4: Github is dead again :/

parent