URL name parts containing semi-colons (;) should pass validation through linkUrl usage

[Alpheus]

To my knowledge semi-colons are a valid character within a URL (atleast for the path) and the current regex in https://github.com/flowplayer/flash/blob/a774e53311824054ece3bf79879be28bfaf317b3/core/src/actionscript/org/flowplayer/util/URLUtil.as does not seem to allow it.

Would be great if this could be fixed. Link structure in question:

http://ad.sample.net/click;foo;bar;v

See http://stackoverflow.com/questions/1178024/can-a-url-contain-a-semi-colon

[danrossi]

Do you have an example of this being used if possible.

[Alpheus]

Nothing in production for now as far as the url is concerned, we're temporarily using a local redirect to handle it but it's less than optimal. Ideally, the sample link above would have to pass validation.

[danrossi]

I mean a config you are using.

[Alpheus]

As far as that clip is concerned:

{
    clip: {
        linkUrl: 'http://ad.sample.net/click;foo;bar;v',
        linkWindow: '_blank'
    }
}

[danrossi]

Ok I thought so, thanks very much. I'll see how easy it is to add that to the regexp filter. I think we need to keep the filter in case of xss links or something like that, the issue is the regexp is not seeing the path correctly because of the ;.

[Alpheus]

I believe the expression below would solve the issue but you'd have to run it against your tests to check if it breaks any of the previously fixed XSS issues.

/^http(s)?:\/\/((\d+\.\d+\.\d+\.\d+)|(([\w-]+\.)+([a-z,A-Z][\w-]*)))(:[1-9][0-9]*)?(\/(?:%+@&=)|([\w-.\/:;%+@&=]+[\w-.\/?:;%+@&=]*)?)?(#(.*))?$/;

[danrossi]

Thankyou i will let you know the regex gets pretty chaotic indeed.

[danrossi]

hi confirming that regex works i can see you added the semi colon no worries.

[danrossi]

fix in https://dl.dropbox.com/u/3394987/flowplayer.commercial-3.2.15.zip

[danrossi]

Hi we'll leave it open to keep it flagged as testing, but thanks for the report ;)

[Alpheus]

Oh, alright - sorry about that, wasn't acquainted with your workflow :) But thanks nonetheless, this has been very productive.

[danrossi]

fixed. closing for now.