Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve escaping of unwanted characters #78

Merged
merged 1 commit into from
Oct 6, 2022

Conversation

happy-barney
Copy link
Contributor

Fixes #74

Problem identified by issue relies in improper quoting and string evaluation in uri_escape. Examples of $unsafe that will not behave very friendly

  • '\'
  • ']['
  • '${ kill -9 -1 }'

@happy-barney
Copy link
Contributor Author

only one windows test failed due setup failure

t/escape.t Outdated
'it should recognize character groups'
;

use URI::Escape qw(%escapes);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this needed? We've already imported %escapes above.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it is not, removed

Copy link
Member

@oalders oalders left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @happy-barney , I don't know how this got missed. Thanks for following up on it.

@oalders oalders merged commit 1a4ed66 into libwww-perl:master Oct 6, 2022
@oalders
Copy link
Member

oalders commented Oct 6, 2022

I've just released it to CPAN. Thanks, @happy-barney!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

URI::Escape::uri_escape( $string, $unsafe ) $unsave can easily be used wrong
2 participants