nkolban / duktape-esp32

A JavaScript runtime for the ESP32 based on Duktape.
Apache License 2.0
238 stars 44 forks source link

SSID containing space character is not URL-decoded #11

Open marcelkottmann opened 7 years ago

marcelkottmann commented 7 years ago

My SSID has a space character, which is not correctly decoded from the http-request after submit. Looking at the log output, it seems, that the characters are not decoded after retrieving them from the http-request. My SSID is "HAL9000 2.4"

D (4133) log: Going to try and connect to AP named "HAL9000+2.4"
D (6141) module_wifi:  - Connecting to access point: "HAL9000+2.4" with "<Password hidden>"

I had the same thing in an arduino sketch some day, and fixed it with this code excerpt:

void decodeUrlComponent(String* value) {
  value->replace("+", " ");
  value->replace("%21", "!");
  value->replace("%22", "\"");
  value->replace("%23", "#");
  value->replace("%24", "$");
  value->replace("%25", "%");
  value->replace("%26", "&");
  value->replace("%27", "'");
  value->replace("%28", "(");
  value->replace("%29", ")");
  value->replace("%2A", "*");
  value->replace("%2B", "+");
  value->replace("%2C", ",");
  value->replace("%2D", "-");
  value->replace("%2E", ".");
  value->replace("%2F", "/");
  value->replace("%3A", ":");
  value->replace("%3B", ";");
  value->replace("%3C", "<");
  value->replace("%3D", "=");
  value->replace("%3E", ">");
  value->replace("%3F", "?");
  value->replace("%40", "@");
}
nkolban commented 7 years ago

Excellent ... thanks for catching this. I'll look into it ASAP. The good news is that large chunks of ESP32-Duktape are themselves written in JavaScript ... so we can leverage the underlying JavaScript APIs to achieve resolution ... for example ...

https://www.w3schools.com/jsref/jsref_decodeuricomponent.asp

I'll find where that is needed in the code base and affect a fix.

Usage of ESP32-Duktape has been low ... ive found that the amount of RAM on an ESP32 basic isn't enough for the majority of work items ... however with the new WROVER, we now have over 4MBytes. Do you have a WROVER?

marcelkottmann commented 7 years ago

No, I have no WROVER, but it looks promising.

decodeURIcomponent leads to an instruction error in my installation...., but i did not looked into it further.

nkolban commented 7 years ago

I have studied the puzzle and exactly as you described, it is a problem. I have affected a fix but not yet tested it. Should you wish to try yourself, edit the JavaScript source file called "filesystem/url.js". Find the function called "queryParse" and change the line which reads:

result[nameValue[0]] = nameValue[1];

to

result[nameValue[0]] = decodeURIComponent(nameValue[1]);

This function is responsible for parsing the SSID sent from the browser. We can see it being used in filesystem/bootwifi.js in the function "startWebServer" where we process the "/ssidSelected" data and we are parsing FORM data from the POST. If you test before I do, please let me know.

boneskull commented 6 years ago

19 is a dupe of this. I sent a PR for it, which is #20.

boneskull commented 6 years ago

the code changes in 9fb31f6 did not work