10
Bug Report: URI Sanitization (sh.itjust.works)
submitted 4 weeks ago by to c/summit@lemmy.world
22 comments fedilink hide all child comments
 

Morning Team,

Please see the thread found at this link, between myself and the OP:

https://sh.itjust.works/post/68082252

I’d like to request that the LinkResolver.ky file be updated so that URIs have their RFC-3986 well-defined Reserved Characters “percent-encoded” before being transferred to a buffer.

If you need an assist on dev for this, lmk :) I’m about since Gingerbread on developing for android, let alone kt but I have the spice😭

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 1 point 4 hours ago (9 children)

Read the RFC dude, the @ symbol must be encoded lol. It sucks ass but it must be done. Last time I made a filter for special chars it was easiest to do a find on the index of the special chars, remove the char from the string array by index, and then inject the encoded value back into the array by index.

Cyberchef is a great resource for testing what right should fuzzily look like, you can also strip logic from them need be on capturing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 1 point 4 hours ago* (last edited 4 hours ago) (8 children)

    Not sure if this is the right RFC but based on https://www.rfc-editor.org/rfc/rfc3986.html:

    From 3.4. Query query = *( pchar / "/" / "?" )

    From 3.3 pchar = unreserved / pct-encoded / sub-delims / ":" / "@"

    Note that "@" is explicitly call out as not encoded.

    Edit: Github is currently down but I am using https://github.com/1184893257/okhttp/blob/master/okhttp/src/main/java/com/squareup/okhttp/HttpUrl.java to encode the URL. If you think their encoding is wrong please open a ticket with them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] [S] 1 point 4 hours ago (7 children)

    2.2. Reserved Characters

    URIs include components and subcomponents that are delimited by characters in the "reserved" set. These characters are called “reserved" because they may (or may not) be defined as delimiters by the generic syntax, by each scheme-specific syntax, or by the implementation-specific syntax of a URI's dereferencing algorithm. If data for a URI component would conflict with a reserved character's purpose as a delimiter, then the conflicting data must be percent-encoded before the URI is formed.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 3 hours ago* (last edited 3 hours ago) (6 children)

    I think you should open a ticket with okhttp.

    If you need help, what you really want to open a ticket with is this:

    static final String QUERY_COMPONENT_ENCODE_SET = " \"<>#&=";

    You want to ask them to add "@" to this set.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] [S] 1 point 3 hours ago (5 children)

    I think you should probanly stop supporting an App if you can’t untangle URL vs URI

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 3 hours ago* (4 children)

    I don't understand. I am pointing you to exactly where to request the change. I even gave you exactly where the problem is in the code. What more do you want from me?

    Sorry. I forgot to include the line in the code: https://github.com/1184893257/okhttp/blob/master/okhttp/src/main/java/com/squareup/okhttp/HttpUrl.java#L266

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] [S] 1 point 3 hours ago (3 children)

    It’s a 10 year old library with little to no support and you’re fighting making your own code to handle the cruft. Truly get and take actual help on the project.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 3 hours ago* (last edited 3 hours ago)

    Last human commit was 4 days ago and the last release was last month. I think it’s still active.

    Edit: Wow I linked to the wrong repository. My bad. Github was experiencing an outage so I pulled the link from google. Here is the real repo: https://github.com/lysine-dev/okhttp

    Edit 2: Github is still struggling but will try to get you the exact location in code once I can load the page.

    Edit 3: Here is the updated location in code: https://github.com/lysine-dev/okhttp/blob/main/okhttp/src/commonJvmAndroid/kotlin/okhttp3/internal/url/-Url.kt#L30.

    You can open a ticket there and explain the issue. They are still closing issues so they should be able to get to it.

    Edit 4: Github is dead again :/

  • permalink
  • fedilink
  • source
  • parent