search

mirrors-tk / feedback

tracking general issues
Other
0 stars 0 forks source link

URL Escape #10

Open Arnie97 opened 2 years ago

Arnie97 commented 2 years ago

Arch 32 和 7-Zip-ZStd 验证过程中发现，不转义不行，全转义也不行（至少不能转义 / 为 %2F，其他符号待考察）。

例如：

/archlinux32/irc-logs/#archlinux-ports/latest.html
/archlinux32/pool/qt5-base-5.15.3+kde+r137-1.1-pentium4.pkg.tar.zst
/archlinux32/pool/remmina-1:1.4.25-1.0-i486.pkg.tar.zst

目前转义成

archlinux32%2Fpool%2Fremmina-1%3A1.4.25-1.0-i486.pkg.tar.zst

导致完全读不到

Arnie97 commented 2 years ago

Permitted characters

RFC 3986 Flags:

Unreserved Path (pchar) Query / fragment

Mirrors.tk Flags:

critical for current usage cases

Alibaba Package Repository Flags:

post request parameter get request path delete request path post response URL

Value explanation for last two columns:

!: must not escape this character %: must be percent encoded *: either way above could work well +: must be replaced with + ?: can not work in any known ways

Escaped Raw U P Q c p g d r
%20 c %+ * % %
%21 ! * * * !
%22 " * * * %
%23 # c % % % %
%24 $ * * * !
%25 % c % % % %
%26 & % * * !
%27 ' * * * !
%28 ( * * * !
%29 ) * * * !
%2A * * * * !
%2B + c % * * !
%2C , * * * !
%2D - U P Q c * * * !
%2E . U P Q c * ? ? !
%2F / Q c * ! ! !
%3A : P Q c * * * !
%3B ; * % % !
%3C < * * * %
%3D = * * * !
%3E > * * * %
%3F ? % % % %
%40 @ P Q c * * * !
%5B [ * * * %
%5C \ * ? ? %
%5D ] * * * %
%5E ^ * * * %
%5F _ U P Q c * * * !
%60 ` * * * %
%7B { * * * %
%7C \| * * * %
%7D } * * * %
%7E ~ U P Q c * * * !

Bad cases that can not be escaped

GET /api/protocol/{orgID}/GENERIC/flow_generic_repo/files/{path}/%2E
HTTP/2 400

{"errorCode":"-1","successful":false}
DELETE /api/protocol/{orgID}/GENERIC/flow_generic_repo/files/{path}/%2E
HTTP/2 500

{"object":{"timestamp":{now},"status":500,"error":"Internal Server Error","exception":"java.lang.IllegalStateException","message":"Pattern \"/.*\" is not a match for \".\"","path":"/api/protocol/{orgID}/GENERIC/flow_generic_repo/files/{path}/%2E"},"successful":true}
GET /api/protocol/{orgID}/GENERIC/flow_generic_repo/files/if-\-or-%5C-was-in-the-url-then-boom
HTTP/2 400
content-length: 0