Bug #46449: Routes should urldecode their parts - TYPO3.Flow - TYPO3 Forge

TYPO3 Flow Base Distribution TYPO3.Eel TYPO3.Flow TYPO3.Fluid TYPO3.Kickstart TYPO3.Welcome Packages Applications

Bug #46449

Routes should urldecode their parts

Added by Adrian Föder over 2 years ago. Updated over 1 year ago.

Status:

Resolved

Start date:

2013-03-20

Priority:

Should have

Due date:

Assigned To:

Bastian Waidelich

% Done:

100%

Category:

MVC - Routing

Target version:

TYPO3 Flow Base Distribution - 2.0.1

PHP Version:

Complexity:

Has patch:

Affected Flow version:

Git master

Description

requesting the following Flow project URI, for example,

http://example.org/acme.package/foo%62ar/create

results in a resolved controllerName of foo%62ar while it should of course be foobar.

This is incorrect by reading; and especially problematic in sub-namespaced controllers like even in nativ Neos' Backend\BackendController (however in this case it's circumvented by a custom route).
Such a controller would be

http://example.org/acme.package/accouting%5Caccount/create

intended to result in an controllerName of accounting\account.

Associated revisions

Revision b4c6e7ed
Added by Bastian Waidelich almost 2 years ago

[BUGFIX] Dynamic RouteParts should be urldecoded

This makes sure that request path segments are urldecoded
during matching and urlencoded during resolving of Routes.

Previously An URI ``/some.package/sub%5Csomecontroller`` was
not decoded correctly leading to a 404.
Now the value is correctly decoded to "sub\somecontroller".

Change-Id: I60dc22fefe92009dcea8fb6e8fd3038785467b1a
Resolves: #46449
Releases: master, 2.1

Revision ebd66125
Added by Bastian Waidelich almost 2 years ago

[BUGFIX] Dynamic RouteParts should be urldecoded

This makes sure that request path segments are urldecoded
during matching and urlencoded during resolving of Routes.

Previously An URI ``/some.package/sub%5Csomecontroller`` was
not decoded correctly leading to a 404.
Now the value is correctly decoded to "sub\somecontroller".

Change-Id: I60dc22fefe92009dcea8fb6e8fd3038785467b1a
Resolves: #46449
Releases: master, 2.0

History

#1 Updated by Adrian Föder over 2 years ago

..the question is whether to decode the whole query string pretty early, making

/foo/bar/this%2Fthat/baz

into

/foo/bar/this/that/baz

which could be unwanted, for example in this case:

/acme.package/books/The%20Wizard%20of%20Oz%2FWonderful%20Wizard%20of%20Oz

this is surely intended to result the title representation

The Wizard of Oz/Wonderful wizard of Oz

so I think the decoding should take place "later" on the value of the route part.

#2 Updated by Bastian Waidelich almost 2 years ago

Status changed from New to Needs Feedback
Priority changed from Must have to Should have

I'm not so sure about this one. We should definitely not decode the complete request path (btw. you mix up query string with request path, for the query string it might be different) because that would prevent you from having dynamic RouteParts containing a slash for instance.
I wonder in what cases you end up with the urlencoded version? I suppose this is a problem with "Object routing". The IdentityRoutePart-Handler should probably de/encode the part!