escape or don't use __ow_path to pass external resource url

[tripodsan]

Description
this action receives the external resource URL as unescaped path suffix via the __ow_path parameter. this has the drawback, that the query parameters of the resource URL bleed into the action parameters. this makes it volatile to changes in the resource URL, since each extractor needs to anticipate the potential query parameters needed. also, it prevents using query params for real action params.

also see:

• feat(excel): support excel spreadsheets on sharepoint sites #6 (comment)
• feat(excel): support excel spreadsheets on sharepoint sites #6 (comment)

Suggestion A

The minimal change that could be done is to url-escape the external resource.

so instead of:

https://adobeioruntime.net/api/v1/web/helix/helix-serivces/data-embed@v1/https://adobe.sharepoint.com/sites/TheBlog/_layouts/15/guestaccess.aspx?share=ESR1N29Z7HpCh1Zfs_0YS_gB4gVSuKyWRut-kNcHVSvkew&email=helix%40adobe.com&e=hx0OUl

we'd use:

https://adobeioruntime.net/api/v1/web/helix/helix-serivces/data-embed@v1/https%3A%2F%2Fadobe.sharepoint.com%2Fsites%2FTheBlog%2F_layouts%2F15%2Fguestaccess.aspx%3Fshare%3DESR1N29Z7HpCh1Zfs_0YS_gB4gVSuKyWRut-kNcHVSvkew%26email%3Dhelix%2540adobe.com%26e%3Dhx0OUl

Suggestion B

an alternative approach is not to use the __ow_path but a normal action parameter, eg:

https://adobeioruntime.net/api/v1/web/helix/helix-serivces/data-embed@v1?r=https%3A%2F%2Fadobe.sharepoint.com%2Fsites%2FTheBlog%2F_layouts%2F15%2Fguestaccess.aspx%3Fshare%3DESR1N29Z7HpCh1Zfs_0YS_gB4gVSuKyWRut-kNcHVSvkew%26email%3Dhelix%2540adobe.com%26e%3Dhx0OUl

[trieloff]

I'd like to keep the change backwards-compatible. This means we could make suggestion B work easily, suggestion A would be a bit harder, but I think we can check for __ow_path starting with either /^https?:\/\/ or /^https%3A%2F%2F/.

Given that we use this approach in helix-embed, too we might even turn this into a generalized wrapper that turns genetic open whisk arguments into cleaned arguments that have a __ow_uri with the extracted or restored URI.

[tripodsan]

I think keeping it backward compatible doesn't gain much and only complicates the checks.
I would rather have a breaking change, and use the new major version.

[trieloff]

🎉 This issue has been resolved in version 1.6.0 🎉

The release is available on:

• v1.6.0
• GitHub release

Your semantic-release bot 📦🚀