search

delan / autost

cohost-compatible blog engine and feed reader
ISC License
24 stars 1 forks source link

cohost2autost: incorrect escaping of rewritten attachment urls #4

Closed delan closed 1 month ago

delan commented 1 month ago

in 90285408f729b9fbbe108306abbcb433e3ef94d6 we fixed the filenames on disk to not be percent encoded, but we failed to actually percent encode the filenames in urls, so anything with a % or ? is broken. for example:

<img src="attachments/a6d33e9c-5b3e-4d0b-b3e7-20820630286d/if you see this font theres a 50% chance that you're on a rust-related website.svg" data-cohost-src="https://staging.cohostcdn.org/attachment/a6d33e9c-5b3e-4d0b-b3e7-20820630286d/if%20you%20see%20this%20font%20theres%20a%2050%25%20chance%20that%20you're%20on%20a%20rust-related%20website.svg" loading="lazy">

the browser sees a 50% chance and requests a%2050%%20chance, which is a 400 bad request in nginx.

delan commented 1 month ago

working on this now, i think this is the last straw for our sloppy path handling. we should have types like PostsPath and SitePath that do all of our path and url manipulations in one place and do them correctly.