Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Double encoding when sanitized URL with encoded symbols like %2F (/), %3B (;) etc. provided to sanitize() function #3270

Closed
stepashka69 opened this issue Oct 15, 2023 · 1 comment · Fixed by #3271
Assignees
Labels
ApiDOM bug Something isn't working

Comments

@stepashka69
Copy link
Contributor

Q&A (please complete the following information)

  • ApiDOM version: 0.77.0

Describe the bug you're encountering

The bug is follow up of the by reported for SwaggerUI swagger-api/swagger-ui#9304 where it causes the practical problem.

Calling the sanitize() function in https://github.com/swagger-api/apidom/blob/main/packages/apidom-reference/src/util/url.ts#L248 cause double encoding when URL already contains encoded 'special' symbols: ; / ? : @ & = + $ , #

To reproduce...

Steps to reproduce the behavior:

  1. Call sanitize() function with URL that contains encoded symbols %2F , %3B etc. Similar to test case https://github.com/swagger-api/apidom/blob/main/packages/apidom-reference/test/util/url.ts#L294 . For example sanitize('https://example.com/path%20with%20spaces%2Fslashes%3Bsemicolons/?including=in%3Fparameters')
  2. The expected output is the same URL: 'https://example.com/path%20with%20spaces%2Fslashes%3Bsemicolons/?including=in%3Fparameters.
    The real output is this: https://example.com/path%20with%20spaces%252Fslashes%253Bsemicolons/?including=in%253Fparameters .
    The % of the %2F and %3B are encoded. It should not happen.

Expected behavior

The encoded URL passed to sanitize() should remain the same for all possible combinations of encoded symbols

Additional context or thoughts

The reason for the issue is that decodeURI() and encodeURI() leave 'special' symbols ; / ? : @ & = + $ , # encoding unchanged. It is mentioned in the documentation at https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/decodeURI#description and https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURI#description .

@char0n
Copy link
Member

char0n commented Oct 17, 2023

Resolved in #3271

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ApiDOM bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants