CGI.escape escapes more than URI.escape

openSUSE · Mar 14, 2022 · c8fa8d9 · c8fa8d9
1 parent e3d5bca
commit c8fa8d9
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 5 deletions.
diff --git a/src/api/app/helpers/webui/webui_helper.rb b/src/api/app/helpers/webui/webui_helper.rb
@@ -13,10 +13,8 @@ def bugzilla_url(email_list = '', desc = '')
       cc = ('&cc=' + email_list[1..-1].join('&cc=')) if email_list
     end
 
-    CGI.escape(
-      "#{@configuration['bugzilla_url']}/enter_bug.cgi?classification=7340&product=openSUSE.org" \
-      "&component=3rd party software&assigned_to=#{assignee}#{cc}&short_desc=#{desc}"
-    )
+    "#{@configuration['bugzilla_url']}/enter_bug.cgi?classification=7340&product=openSUSE.org" \
+      "&component=3rd%20party%20software&assigned_to=#{CGI.escape(assignee.to_s)}#{CGI.escape(cc.to_s)}&short_desc=#{CGI.escape(desc.to_s)}"
   end
 
   def fuzzy_time(time, with_fulltime = true)

diff --git a/src/api/spec/helpers/webui/webui_helper_spec.rb b/src/api/spec/helpers/webui/webui_helper_spec.rb
@@ -84,7 +84,7 @@
     it 'adds an assignee and description if parameters where given' do
       expected_attributes = @expected_attributes.clone
       expected_attributes[:short_desc] = 'some_description'
-      expected_attributes[:assigned_to] = 'assignee@example.org'
+      expected_attributes[:assigned_to] = 'assignee%40example.org'
 
       expected_url = 'https://bugzilla.example.org/enter_bug.cgi?' +
                      expected_attributes.map { |key, value| "#{key}=#{value}" }.join('&')