Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prevent double decoding of % in url params #17997

Merged
merged 4 commits into from
Dec 16, 2021
Merged

Prevent double decoding of % in url params #17997

merged 4 commits into from
Dec 16, 2021

Commits on Dec 15, 2021

  1. Prevent double decoding of % in url params 

    There was an unfortunate regression in go-gitea#14293 which has led to the double decoding
of url parameter elements if they contain a '%'. This is due to an issue
with the way chi decodes its RoutePath. In detail the problem lies in
mux.go where the routeHTTP path uses the URL.RawPath or even the
URL.Path instead of the escaped path to do routing.

This PR simply forcibly sets the routePath to that of the EscapedPath.

Fix go-gitea#17938

Signed-off-by: Andrew Thornton <art27@cantab.net>
    @zeripath
    zeripath committed Dec 15, 2021
    Configuration menu
    Copy the full SHA
    4298560 View commit details
    Browse the repository at this point in the history

Commits on Dec 16, 2021

  1. Add additional test cases 

    Signed-off-by: Andrew Thornton <art27@cantab.net>
    @zeripath
    zeripath committed Dec 16, 2021
    Configuration menu
    Copy the full SHA
    7810566 View commit details
    Browse the repository at this point in the history

  2. Merge branch 'main' into fix-17938-fix-double-decoding

    @lunny
    lunny committed Dec 16, 2021
    Configuration menu
    Copy the full SHA
    a20ee9a View commit details
    Browse the repository at this point in the history

  3. Merge branch 'main' into fix-17938-fix-double-decoding

    @lunny
    lunny committed Dec 16, 2021
    Configuration menu
    Copy the full SHA
    7bbdf08 View commit details
    Browse the repository at this point in the history