10
Bug Report: URI Sanitization (sh.itjust.works)
submitted 4 weeks ago by to c/summit@lemmy.world
22 comments fedilink hide all child comments
 

Morning Team,

Please see the thread found at this link, between myself and the OP:

https://sh.itjust.works/post/68082252

I’d like to request that the LinkResolver.ky file be updated so that URIs have their RFC-3986 well-defined Reserved Characters “percent-encoded” before being transferred to a buffer.

If you need an assist on dev for this, lmk :) I’m about since Gingerbread on developing for android, let alone kt but I have the spice😭

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 12 hours ago* (10 children)

Bleh this is more complex than I thought. I thought I could just use a library function to encode it but when I pass in the URL and encode it it just gives the same string back. Turns out '@' is a valid symbol for a query param and does not need to be encoded. I might have to say this the URL is valid and it's the website that is wrong.

I could do something hacky and just manually replace any @ with the encoded form though. It's not hard but I would prefer not to.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] [S] 1 point 11 hours ago (9 children)

    Read the RFC dude, the @ symbol must be encoded lol. It sucks ass but it must be done. Last time I made a filter for special chars it was easiest to do a find on the index of the special chars, remove the char from the string array by index, and then inject the encoded value back into the array by index.

    Cyberchef is a great resource for testing what right should fuzzily look like, you can also strip logic from them need be on capturing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 1 point 10 hours ago* (last edited 10 hours ago) (8 children)

    Not sure if this is the right RFC but based on https://www.rfc-editor.org/rfc/rfc3986.html:

    From 3.4. Query query = *( pchar / "/" / "?" )

    From 3.3 pchar = unreserved / pct-encoded / sub-delims / ":" / "@"

    Note that "@" is explicitly call out as not encoded.

    Edit: Github is currently down but I am using https://github.com/1184893257/okhttp/blob/master/okhttp/src/main/java/com/squareup/okhttp/HttpUrl.java to encode the URL. If you think their encoding is wrong please open a ticket with them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] [S] 1 point 10 hours ago (7 children)

    2.2. Reserved Characters

    URIs include components and subcomponents that are delimited by characters in the "reserved" set. These characters are called “reserved" because they may (or may not) be defined as delimiters by the generic syntax, by each scheme-specific syntax, or by the implementation-specific syntax of a URI's dereferencing algorithm. If data for a URI component would conflict with a reserved character's purpose as a delimiter, then the conflicting data must be percent-encoded before the URI is formed.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 10 hours ago* (last edited 10 hours ago) (6 children)

    I think you should open a ticket with okhttp.

    If you need help, what you really want to open a ticket with is this:

    static final String QUERY_COMPONENT_ENCODE_SET = " \"<>#&=";

    You want to ask them to add "@" to this set.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] [S] 1 point 10 hours ago (5 children)

    I think you should probanly stop supporting an App if you can’t untangle URL vs URI

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 10 hours ago* (4 children)

    I don't understand. I am pointing you to exactly where to request the change. I even gave you exactly where the problem is in the code. What more do you want from me?

    Sorry. I forgot to include the line in the code: https://github.com/1184893257/okhttp/blob/master/okhttp/src/main/java/com/squareup/okhttp/HttpUrl.java#L266

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] [S] 1 point 10 hours ago (3 children)

    It’s a 10 year old library with little to no support and you’re fighting making your own code to handle the cruft. Truly get and take actual help on the project.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 9 hours ago* (last edited 9 hours ago)

    Last human commit was 4 days ago and the last release was last month. I think it’s still active.

    Edit: Wow I linked to the wrong repository. My bad. Github was experiencing an outage so I pulled the link from google. Here is the real repo: https://github.com/lysine-dev/okhttp

    Edit 2: Github is still struggling but will try to get you the exact location in code once I can load the page.

    Edit 3: Here is the updated location in code: https://github.com/lysine-dev/okhttp/blob/main/okhttp/src/commonJvmAndroid/kotlin/okhttp3/internal/url/-Url.kt#L30.

    You can open a ticket there and explain the issue. They are still closing issues so they should be able to get to it.

    Edit 4: Github is dead again :/

  • permalink
  • fedilink
  • source
  • parent