Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

#1448 url encoding with lower case letters #1456

Closed
wants to merge 5 commits into from
Closed

Conversation

mstrewe
Copy link
Contributor

@mstrewe mstrewe commented Jan 27, 2025

Will fix #1448 the lower case url encoding error. Test added

@rzo1
Copy link
Contributor

rzo1 commented Jan 27, 2025

Formatting seems to be off. Think you can resolve that by running

mvn git-code-format:format-code -Dgcf.globPattern="**/*" -Dskip.format.code=false

Copy link
Contributor

@sebastian-nagel sebastian-nagel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @mstrewe,

thanks for the PR.

Please, see the comment regarding the uppercase representation of percent-encodings.

void testProperURLEncodingWithLowerCase() throws MalformedURLException {
URLFilter urlFilter = createFilter(queryParamsToFilter);
String urlWithEscapedCharacters = "http://www.example.com/Exhibitions/Detail/NjAxOA%3d%3d";
String expectedResult = "http://www.example.com/Exhibitions/Detail/NjAxOA%3d%3d";
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't the expected result be %3D%3D?

This is the canonical representation of percent-encoded characters defined in RFC 3986.

If case variants of percent-encoded chars remain in URLs, this may cause duplicates. Note that in addition to pure lowercase variant, there could be also %3d%3D and %3D%3d.

@sebastian-nagel
Copy link
Contributor

sebastian-nagel commented Jan 28, 2025

After a closer look into the code: the reason for the issue is likely in line 398 of BasicURLNormalizer.

  • a percent character is unconditionally converted to %25 even if it's the first character of a valid percent-encoding
  • the "basic" URL normalizers of Nutch and crawler-commons treat the percent character separately and do not unconditionally escape it. All three "basic" URL normalizers share the same origin years ago, so they are still quite similar in their source code.

@mstrewe
Copy link
Contributor Author

mstrewe commented Jan 28, 2025

After a closer look into the code: the reason for the issue is likely in line 398 of BasicURLNormalizer.

  • a percent character is unconditionally converted to %25 even if it's the first character of a valid percent-encoding
  • the "basic" URL normalizers of Nutch and crawler-commons treat the percent character separately and do not unconditionally escape it. All three "basic" URL normalizers share the same origin years ago, so they are still quite similar in their source code.

I dont think so.
In the given URL of the test, the URL is unescaped first in line 146 and then escaped in 147. Until now the encoding differ only in upper and lower case (the percent is not yet encoded again)

// .../NjAxOA%3d%3d     - file
String file2 = unescapePath(file);
// .../NjAxOA==    - file2
file2 = escapePath(file2);
// .../NjAxOA%3D%3D   - file2

So the escaping unescaping works like expected.

But since the letters now upper case equals (without ignore case) will lead to line 152, which will create a new URL with file 2.

urlToFilter = new URL(protocol, host, port, file2).toString();

This line will then encode the percentage character again. Then we have .../NjAxOA%253D%253D

@sebastian-nagel
Copy link
Contributor

Ok, this might require to run a debugger. But it doesn't seem to be the URL constructor:

jshell> new URL("http", "www.example.com", -1, "/NjAxOA%3D%3D").toString();
$1 ==> "http://www.example.com/NjAxOA%3D%3D"

@mstrewe
Copy link
Contributor Author

mstrewe commented Jan 28, 2025

I ran the test again, without the fix.

It returned

BasicURLNormalizerTest.testProperURLEncodingWithLowerCase:313 Failed to normalize url encoded url with lower case letters ==> expected: <http://www.example.com/Exhibitions/Detail/NjAxOA%3d%3d> but was: <http://www.example.com/Exhibitions/Detail/NjAxOA%3D%3D>

It seems to work correctly.

I found the bug in my software using maybe an older version.. I will investigate

@mstrewe
Copy link
Contributor Author

mstrewe commented Jan 28, 2025

OK found it.

In my Version the line 154 is the following

urlToFilter = new URI(protocol, null, host, port, file2, null, null).toURL().toString();

Sorry for bothering you. I will close the merge Request since problem was my old code.

@mstrewe mstrewe closed this Jan 28, 2025
@sebastian-nagel
Copy link
Contributor

Sorry for bothering you. I will close the merge Request since problem was my old code.

No problem. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

BasicUrlNomalizer Double Encoding of % when code is written in smaller letters
3 participants