API website generates invalid URLs

[jtdaugherty]

Summary

The API website generates invalid URLs (i.e. with URL-unsafe characters that are not percent-encoded).

Steps to reproduce

1. Go to https://api.mattermost.com/
2. Click the "Channels" section
3. Click a request (in this case "Patch a channel")
4. The browser's URL contains curly braces that are not URL-encoded.

Expected behavior

The URL's curly braces are URL-encoded as per the URL RFC.

Observed behavior (that appears unintentional)

The URL in the browser's address bar contains un-encoded curly braces ({ and }), making that URL hostile in environments where the curly braces are not expected (because they are not valid in URLs).

Possible fixes

URL-encode the unsafe characters.

Resources

• https://perishablepress.com/stop-using-unsafe-characters-in-urls/
• https://www.ietf.org/rfc/rfc1738.txt
• https://en.wikipedia.org/wiki/Percent-encoding

[amyblais]

@jtdaugherty Would you be open to investigate further with https://github.com/Redocly/redoc?

[jtdaugherty]

Hi @amyblais - I am not sure what you are requesting of me. Can you say more?

[amyblais]

I had asked our team about this and they suggested the issue is most likely in the link generated by the API documentation.

You can see more on the discussion in this thread https://community.mattermost.com/core/pl/1kejrc7xbiym7yxnxop71zejwh on our community server if you have any additional questions.

[amyblais]

Ticket: https://mattermost.atlassian.net/browse/MM-30799

[hmhealey]

Those curly brackets don't actually need to be percent-encoded. They're wrapping a placeholder, so they shouldn't be included in a real request