Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SR-15512] URLComponents percent-decodes paths which contain a semicolon #3352

Open
karwa opened this issue Nov 23, 2021 · 0 comments
Open

[SR-15512] URLComponents percent-decodes paths which contain a semicolon #3352

karwa opened this issue Nov 23, 2021 · 0 comments
Labels
bug Foundation

Comments

@karwa
Copy link
Contributor

karwa commented Nov 23, 2021

Previous ID SR-15512
Radar None
Original Reporter @karwa
Type Bug
Environment

macOS 11.6, Xcode 13.1 (13A1030d)

Additional Detail from JIRA
Votes 0
Component/s Foundation
Labels Bug
Assignee None
Priority Medium

md5: aaea3663eae14ba3252b1c92812396ad

Issue Description:

And since URLComponents is the only way to get a URL's percentEncodedPath, it becomes impossible to get the non-decoded path of a URL if that path contains a semicolon.

//                               This semicolon
//                                      V
// URLComponents(url: URL(string: "file:;%2Fabc%2Fdef%2F")!, resolvingAgainstBaseURL: true)?.percentEncodedPath
// "%3B/abc/def/"
//
// URLComponents(url: URL(string: "file:%2Fabc%2Fdef%2F")!, resolvingAgainstBaseURL: true)?.percentEncodedPath
// "%2Fabc%2Fdef%2F"

This combines with SR-15508 so creating a URLComponents can actually remove the path entirely if it contains invalid UTF-8. There's no way to read this path.

let url = URL(string:"s:/;foo%82")!
let comps = URLComponents(url: url, resolvingAgainstBaseURL: true)!

print(url) // "s:/;foo%82"
print(url.path) // "" - this is SR-15508

print(comps.string) // "s:" - the URLComponents initializer does it, too!
print(comps.path) // ""
print(comps.percentEncodedPath) // ""

I found some other interesting cases during fuzzing, so I'm including them here with the WebURL result (which should be what Foundation does after '.standardize' - at least for these cases, there's no WebURL-specific path normalization rules):

(string: "file:%2F;", webURL: "file:///%2F;"),
(string: "w:/s%E3;", webURL: "w:/s%E3;"),
(string: "s:/;%2F.", webURL: "s:/;%2F."),
(string: "fte:;%82", webURL: "fte:;%82"),
(string: "s:/;%2F/../x", webURL: "s:/x"),
(string: "B:/;/../%FF", webURL: "b:/%FF"),
(string: "B:/;%2F/..", webURL: "b:/"),
@swift-ci swift-ci transferred this issue from apple/swift-issues Apr 25, 2022
@shahmishal shahmishal transferred this issue from apple/swift May 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Foundation
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@karwa