search

arut / nginx-dav-ext-module

nginx WebDAV PROPFIND,OPTIONS,LOCK,UNLOCK support
BSD 2-Clause "Simplified" License
469 stars 115 forks source link

gen-delims (brackets) not escaped in href #45

Open chrysn opened 5 years ago

chrysn commented 5 years ago

When files with brackets ([, ]) in their file names are listed, those characters are not escaped, causing some clients to ignore them. (This was previously pointed out as a bug in davfs2, but found to be on nginx-dav-ext-module's side).

Characters not in pchar (from Simple-ref via path-absolute and segment) should be escaped per RFCs 4918 and 3986.

A working solution is to replace, in the two calls to ngx_escape_uri in ngx_http_dav_ext_module.c, NGX_ESCAPE_URI with NGX_ESCAPE_URI_PATH, which is a new version that'd need to be introduced in ngx_string.[hc]. It leaves the slashes unharmed but escapes almost everything else (so it's a copy of NGX_ESCAPE_ARGS but with the slash left unescaped). I can't really propose that change to upstream before dav-ext-module acknowledges its use case, so: would that work for you?

(This is a successor to #6, which started escaping but only solved the cases many more clients are sensitive to, but not all the cases of not being pchar.)

Kihara777 commented 4 years ago

Replace it with NGX_ESCAPE_URI_PATH throw errors when compile the source, so I checked the doc: Screenshot_20200222-083227~2 Then replace it with NGX_ESCAPE_URI_COMPONENT, reconpile the module, and everything works fine now.

notaLonelyDay commented 7 months ago

Why does issue is still open, if it was fixed in https://github.com/MkfsSion/nginx-dav-ext-module/commit/efbadc174a64c38b8df806685aa21aa0ed3120c6

?

@MkfsSion @chrysn