aurelia / router

A powerful client-side router.
MIT License
120 stars 115 forks source link

Child router parameters in route with special characters behavior is unpredictable #424

Open MT-PL-SWF-Dev opened 7 years ago

MT-PL-SWF-Dev commented 7 years ago

I'm submitting a bug report

Please tell us about your environment:

Current behavior: When using child routes with string parameters, uri resolving crashes when using special characters encoded in %XX format. E.g. route "#/main/child/%25" throws "URIError: URI malformed" thrown from RouteRecognizer.recognize() function line that uses decodeUri() function. Another special characters problem occurs randomly. E.g. route "#/main/child/fsd%40%2135%2A%28%29" navigates for the first time. When I try to navigate to exactly same location router throws " Error: Route not found".

Issue reproducted in Gist: https://gist.run/?id=2e0ff35d2e08641448e536d639e31a12

Expected/desired behavior: I'd like to use route parameter for search string, which is robust and as bulletproof as possible.

MT-PL-SWF-Dev commented 7 years ago

I have found anohter clue in this case. https://github.com/aurelia/router/blob/master/src/navigation-instruction.js#L175 It is run after child-router navigation. With % coded characters method "encodeURI" parse them and change e.g. %25 to %2525. It breaks child router by setting baseUrl to "".

bigopon commented 5 years ago

This is an issue with encodeURI and decodeURI API pair. They are meant to be used on full URI while in the router, we typically supplied the fragment, with query string/hash only. Could simply be fixed by changing encodeURI -> encodeURIComponent and decodeURI -> decodeURIComponent

@EisenbergEffect @davismj @fkleuver @jwx

bigopon commented 5 years ago

Hmm, it was a wrong analysis. Please ignore

mjpearse commented 3 years ago

Ran into what I think was this issue today with a string parameter going through the router. I didn't want to change it to a setting on the route as I wanted the user to be able to refresh the page on the other side.

My workaround was to encode the string as a base64 url encoded string rather than the usual encodeURIComponent (which was not working).