소스 검색

AK: Iterate the bytes of a URL query with an unsigned type

Otherwise, we percent-encode negative signed chars incorrectly. For
example, https://www.strava.com/login contains the following hidden
<input> field:

    <input name="utf8" type="hidden" value="✓" />

On submitting the form, we would percent-encode that field as:

    utf8=%-1E%-64%-6D

Which would cause us to receive an HTTP 500 response. We now properly
percent-encode that field as:

    utf8=%E2%9C%93

And can login to Strava :^)
Timothy Flynn 1 년 전
부모
커밋
e3b5e24ce0
2개의 변경된 파일10개의 추가작업 그리고 1개의 파일을 삭제
  1. 1 1
      AK/URLParser.cpp
  2. 9 0
      Tests/AK/TestURL.cpp

+ 1 - 1
AK/URLParser.cpp

@@ -714,7 +714,7 @@ ErrorOr<String> URLParser::percent_encode_after_encoding(StringView input, URL::
     StringBuilder output;
     StringBuilder output;
 
 
     // 3. For each byte of encodeOutput converted to a byte sequence:
     // 3. For each byte of encodeOutput converted to a byte sequence:
-    for (auto byte : input) {
+    for (u8 byte : input) {
         // 1. If spaceAsPlus is true and byte is 0x20 (SP), then append U+002B (+) to output and continue.
         // 1. If spaceAsPlus is true and byte is 0x20 (SP), then append U+002B (+) to output and continue.
         if (space_as_plus && byte == ' ') {
         if (space_as_plus && byte == ' ') {
             output.append('+');
             output.append('+');

+ 9 - 0
Tests/AK/TestURL.cpp

@@ -438,6 +438,15 @@ TEST_CASE(unicode)
     EXPECT(!url.fragment().has_value());
     EXPECT(!url.fragment().has_value());
 }
 }
 
 
+TEST_CASE(query_with_non_ascii)
+{
+    URL url { "http://example.com/?utf8=✓"sv };
+    EXPECT(url.is_valid());
+    EXPECT_EQ(url.serialize_path(), "/"sv);
+    EXPECT_EQ(url.query(), "utf8=%E2%9C%93");
+    EXPECT(!url.fragment().has_value());
+}
+
 TEST_CASE(complete_file_url_with_base)
 TEST_CASE(complete_file_url_with_base)
 {
 {
     URL url { "file:///home/index.html" };
     URL url { "file:///home/index.html" };