-
Notifications
You must be signed in to change notification settings - Fork 9.4k
Closed
Closed
Copy link
Labels
Area: SecurityComponent: EncryptionIssue: ConfirmedGate 3 Passed. Manual verification of the issue completed. Issue is confirmedGate 3 Passed. Manual verification of the issue completed. Issue is confirmedPriority: P2A defect with this priority could have functionality issues which are not to expectations.A defect with this priority could have functionality issues which are not to expectations.Progress: doneReported on 2.4.xIndicates original Magento version for the Issue report.Indicates original Magento version for the Issue report.Reproduced on 2.4.xThe issue has been reproduced on latest 2.4-develop branchThe issue has been reproduced on latest 2.4-develop branch
Description
This issue is automatically created based on existing pull request: #35885: URLs should not contains reserved characters according to RFC 3986
Description (*)
This PR fixes the RFC 3986 which forbids to use reserved characters in URLs such as a comma.
Related Pull Requests
Manual testing scenarios (*)
- Use the URL :
http://magento2.adobe/encoding/with/longer/url/
- Encode this URL with the
Magento\Framework\Url\Encoder::encode
method - Note that the base64 encoded URL contains a comma :
aHR0cDovL21hZ2VudG8yLmFkb2JlL2VuY29kaW5nL3dpdGgvbG9uZ2VyL3VybC8,
- Use the native method rawurlencode from PHP on the result :
aHR0cDovL21hZ2VudG8yLmFkb2JlL2VuY29kaW5nL3dpdGgvbG9uZ2VyL3VybC8%2C
(please notice the %2C character which is the hexadecimal value for a comma, which is not allowed. - Decode this URL back :
http://magento2.adobe/encoding/with/longer/url/6
(a6
was added at the end of the URL because of the encoded value)
Questions or comments
In my understanding of the RFC, an URL can't contain a comma (or whatever reserved characters). However, Magento uses such character in the encode
method to remove the =
character from the base64 encoded value.
return strtr(base64_encode($url), '+/=', '-_,'); |
This PR replaces the comma value by a tilde as this is an unreserved character allowed for an URL and which will not be transformed in the rawurlencode
method.
Contribution checklist (*)
- Pull request has a meaningful description of its purpose
- All commits are accompanied by meaningful commit messages
- All new or changed code is covered with unit/integration tests (if applicable)
- README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
- All automated tests passed successfully (all builds are green)
Metadata
Metadata
Assignees
Labels
Area: SecurityComponent: EncryptionIssue: ConfirmedGate 3 Passed. Manual verification of the issue completed. Issue is confirmedGate 3 Passed. Manual verification of the issue completed. Issue is confirmedPriority: P2A defect with this priority could have functionality issues which are not to expectations.A defect with this priority could have functionality issues which are not to expectations.Progress: doneReported on 2.4.xIndicates original Magento version for the Issue report.Indicates original Magento version for the Issue report.Reproduced on 2.4.xThe issue has been reproduced on latest 2.4-develop branchThe issue has been reproduced on latest 2.4-develop branch
Type
Projects
Status
Done