Skip to content

[Issue] URLs should not contains reserved characters according to RFC 3986 #36042

@m2-assistant

Description

@m2-assistant

This issue is automatically created based on existing pull request: #35885: URLs should not contains reserved characters according to RFC 3986


Description (*)

This PR fixes the RFC 3986 which forbids to use reserved characters in URLs such as a comma.

Related Pull Requests

Manual testing scenarios (*)

  1. Use the URL : http://magento2.adobe/encoding/with/longer/url/
  2. Encode this URL with the Magento\Framework\Url\Encoder::encode method
  3. Note that the base64 encoded URL contains a comma : aHR0cDovL21hZ2VudG8yLmFkb2JlL2VuY29kaW5nL3dpdGgvbG9uZ2VyL3VybC8,
  4. Use the native method rawurlencode from PHP on the result : aHR0cDovL21hZ2VudG8yLmFkb2JlL2VuY29kaW5nL3dpdGgvbG9uZ2VyL3VybC8%2C (please notice the %2C character which is the hexadecimal value for a comma, which is not allowed.
  5. Decode this URL back : http://magento2.adobe/encoding/with/longer/url/6 (a 6 was added at the end of the URL because of the encoded value)

Questions or comments

In my understanding of the RFC, an URL can't contain a comma (or whatever reserved characters). However, Magento uses such character in the encode method to remove the = character from the base64 encoded value.

return strtr(base64_encode($url), '+/=', '-_,');

This PR replaces the comma value by a tilde as this is an unreserved character allowed for an URL and which will not be transformed in the rawurlencode method.

Contribution checklist (*)

  • Pull request has a meaningful description of its purpose
  • All commits are accompanied by meaningful commit messages
  • All new or changed code is covered with unit/integration tests (if applicable)
  • README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
  • All automated tests passed successfully (all builds are green)

Metadata

Metadata

Assignees

No one assigned

    Labels

    Area: SecurityComponent: EncryptionIssue: ConfirmedGate 3 Passed. Manual verification of the issue completed. Issue is confirmedPriority: P2A defect with this priority could have functionality issues which are not to expectations.Progress: doneReported on 2.4.xIndicates original Magento version for the Issue report.Reproduced on 2.4.xThe issue has been reproduced on latest 2.4-develop branch

    Type

    No type

    Projects

    Status

    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions