Colon ':' in urls causing problems

[sii]

Relating to this issue:
owncloud/core#23740

Tested on php 7.0.4 on Ubuntu 16.04.

The parse function in lib/functions.php has trouble with colon characters in the wrong place in the uri.
The parse function in turn uses php's parse_url function which is what is failing under certain (odd) circumstances.

If there is a colon character as the second to last character in a uri phps parse_url function fails to parse the uri. When phps parse_url function fails and returns false, sabres parse function also fails.
It's also worth noting that phps parse_url works if you move the colon anywhere else in the string.

Here's how this can be reproduced:

<?php
print "Works:\n";
var_dump(parse_url('/webdav/test3'));
print "\nFails:\n";
var_dump(parse_url('/webdav/test:3'));
?>

I'm not sure how or where this is most appropriate to fix.

Thanks

[evert]

Hi!

Could you log in this as a php bug? If they acknowledge it we can think of building a workaround.

[evert]

I think part of the problem is that :3 is probably being picked up as a port. Changing 3 to a cause it to succeed.

I think the fact that it starts with a / should have caused parse_url to have picked this up as a relative reference though, because / is not allowed in a uri scheme anyway.

[e-alfred]

Will this bug be solved anytime soon? Projects like Owncloud are still being affected by this:

owncloud/core#23740

[staabm]

@e-alfred feel free to provide a unit test and bugfix

[evert]

The earlier comments still stand. Bug report to the php project would be a great first start.

[e-alfred]

Here is a bug report about it: https://bugs.php.net/bug.php?id=55511

They say it is not a bug on their side.

From owncloud/core#25479.

[staabm]

sounds like a colon needs to be encoded when part of the url-path

[PVince81]

but then it was said that the spec was superseded and it doesn't need to be encoded any more:

The quoted spec has been superseded by RFC 3986 and that does allow colons in the path.

[PVince81]

@evert wait for a PHP-side fix or put a workaround in Sabre ?

[evert]

I'm cool with a workaround in sabre/uri.

[PVince81]

I tried @Xenopathic's regexp '/(?:[^[:ascii:]]|:)/u', and it seems to match colons fine and also non-ascii chars. I'll prepare a PR.

[PVince81]

Argh, looks like this would break other cases where the URL is absolute: "http://..." would also encode the colon. And since we haven't parsed the URL yet we can't know which part is the path... Chicken-egg.

Another is then to do another regexp that only replaces the colon only if it appears after any first slash in the string.

What do you think ?

[staabm]

Another is then to do another regexp that only replaces the colon only if it appears after any first slash in the string.

not sure we support this, but colons can also appear as a username:password pair within the host portion.

[PVince81]

PR here #12