search

yast / yast-yast2

YaST module yast2
http://en.opensuse.org/Portal:YaST
GNU General Public License v2.0
55 stars 44 forks source link

Do not escape $ in URI paths #1183

Closed dgdavid closed 3 years ago

dgdavid commented 3 years ago

Problem

When editing a repository using the "Edit Parts of the URL" mode, YaST does not handle the dollar sign properly (escaping it to "%24").

Solution

Just include $ into URLRecode.PATH_SAFE_CHARS.

I evaluated (and discarded) the possibility to refactor URLRecode for making it RFC3986 compliant, but it does not pay off.

Notes

Adding changes from SP1 on

Having a look at skelcds it could be checked that $releasever was used from openSUSE Leap 15.1 on. That's why the change is going to be included in SLE-15-SP1+ branches.

Revisiting URI parts

         foo://example.com:8042/over/there?name=ferret#nose
         \_/   \______________/\_________/ \_________/ \__/
          |           |            |            |        |
       scheme     authority       path        query   fragment

Allowed chars for the URI path according to RFC3986

As the RFC states (see Appendix A for a quick view), an already percentage encoded (%\h\h) and /a-zA-Z0-9-._~!$&'()*+,;=:@ are perfectly valid chars for the URI path. This can be expressed with below regexp

/%\h{2}|[\/a-zA-Z0-9-._~!$&'()*+,;=:@]/

However, refactoring URLRecode for being compliant with RFC3986 not only when escaping the path but when doing so for userinfo and query is not as easy as it might appear at first sight. Furthermore, is not even necessary for the limited YaST URI handling so far.

Discouraging the use of URLRecode (2021-07-28)

We have added a kind of deprecation note from SLE-15-SP3 on, where a Y2Packager::ZyppUrl class was added for dealing with libzypp urls. See https://github.com/yast/yast-yast2/pull/1190 and https://github.com/yast/yast-yast2/pull/1191

Tests

MR: https://build.suse.de/request/show/245221 (after fixing a broken test in #1185)

lslezak commented 3 years ago

For the future I'd suggest to drop the "Edit Parts of the URL" feature completely. I guess in most cases the users just copy&paste a whole URL anyway. Building URLs manually from separate parts is a bit overkill IMHO and not used much. If you need to edit the URL you can edit whole URL, just like in a web browser...