Skip to content

Commit

Permalink
revert #273 with explaination
Browse files Browse the repository at this point in the history
  • Loading branch information
tarunKoyalwar committed Oct 31, 2023
1 parent 59327f5 commit e2a4298
Show file tree
Hide file tree
Showing 3 changed files with 9 additions and 6 deletions.
7 changes: 7 additions & 0 deletions url/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,13 @@ scanme.sh/%invalid/path
- `.UpdateRelPath(newrelpath string, unsafe bool)`
- `.Clone()` and more

- Dealing with Double URL Encoding of chars like `%0A` when `.Path` is directly updated

when `url.Parse` is used to parse url like `https://127.0.0.1/%0A` it internally calls `u.setPath` which decodes `%0A` to `\n` and saves it in `u.Path` and when final url is created at time of writing to connection in http.Request Path is then escaped again thus `\n` becomes `%0A` and final url becomes `https://127.0.0.1/%0A` which is expected/required behavior.

If `u.Path` is changed/updated directly after `url.Parse` ex: `u.Path = "%0A"` then at time of writing to connection in http.Request, Path is escaped again thus `%0A` becomes `%250A` and final url becomes `https://127.0.0.1/%250A` which is not expected/required behavior to avoid this we manually unescape/decode `u.Path` and we set `u.Path = unescape(u.Path)` which takes care of this edgecase.

This is how `utils/url/URL` handles this edgecase when `u.Path` is directly updated.

### Note

Expand Down
6 changes: 1 addition & 5 deletions url/url.go
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ func (u *URL) Clone() *URL {
// String
func (u *URL) String() string {
var buff bytes.Buffer
if u.Scheme != "" {
if u.Scheme != "" && u.Host != "" {
buff.WriteString(u.Scheme + "://")
}
if u.User != nil {
Expand Down Expand Up @@ -308,10 +308,6 @@ func ParseURL(inputURL string, unsafe bool) (*URL, error) {
}
if u.IsRelative {
return ParseRelativePath(inputURL, unsafe)
} else if unsafe {
// we are not relative, but we still need to call this in order to call
// the internal parser for paths url.Parse will not handle.
u.parseUnsafeRelativePath()
}
return u, nil
}
Expand Down
2 changes: 1 addition & 1 deletion url/url_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@ func TestParseInvalidUnsafe(t *testing.T) {
for _, input := range testcases {
u, err := ParseURL(input, true)
require.Nilf(t, err, "got error for url %v", input)
require.Equal(t, input, u.String())
require.Equal(t, input, u.URL.String())
}
}

Expand Down

0 comments on commit e2a4298

Please sign in to comment.