HGKeeper

Stop using g_uri_escape_string() to escape the URI before launching it.
release-2.x.y
2014-01-13, Mark Doliner

41e1147347a5

Executable

Stop using g_uri_escape_string() to escape the URI before launching it.

This was wrong. Take this URL as an example:
https://developer.pidgin.im/search?q=brains&noquickjump=1&wiki=on

When escaped with g_uri_escape_string() it becomes:
https://developer.pidgin.im/search%3Fq%3Dbrains%26noquickjump%3D1%26wiki%3Don

?, = and & are replaced with %3F, %3D and %26 which means they are considered part of the path component rather than query args. I tested and I get 404s when launching that URL with Firefox, Google Chrome, and these manual commands: gnome-open, xdg-open, firefox, google-chrome.

Strangely I DON'T get a 404 when I launch the URL with Konqueror. The original unescaped URL loads. I consider this to be a bug in Konqueror. They would fail to load when launched with a URL that has a question mark as part of the path component because they would convert the remaining path into the query string.

So I ripped out uri_escaped and used uri in its place everywhere.

This bug never got released. We changed the behavior because someone reported
to us that this URL:
http://example.org/$(xterm)
caused xterm to be executed on his system. Obviously that's bad if that
happens, but I don't think it's a bug in Pidgin. We're correctly escaping
all arguments that we pass to the browser command. If a system unescapes those
at some point and execs them, then that system is dangerously broken.

I tested this newest code with Firefox, Google Chrome, Konqueror, and the
manual commands gnome-open and xdg-open and they all work perfectly for me.

#! /bin/sh

# Pidgin and Finch: The Pimpin' Penguin IM Clients That're Good for the Soul

# This program is free software; you can redistribute it and/or modify it

# under the terms of the GNU General Public License as published by the Free

# Software Foundation; either version 2 of the License, or (at your option)

# any later version.

# This program is distributed in the hope that it will be useful, but WITHOUT

# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for

# more details.

# You should have received a copy of the GNU General Public License along with

# this program; if not, write to the Free Software Foundation, Inc., 51

# Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

###############################################################################

# Usage

###############################################################################

# This script uses a config file that can be used to stash common arguments

# passed to configure or environment variables that need to be set before

# configure is called. The configuration file is a simple shell script that

# gets sourced.

# By default, the config file that is used is named 'autogen.args'. This can

# be configured below.

# Available options that are handled are as follow:

# ACLOCAL_FLAGS - command line arguments to pass to aclocal

# AUTOCONF_FLAGS - command line arguments to pass to autoconf

# AUTOHEADER_FLAGS - command line arguments to pass to autoheader

# AUTOMAKE_FLAGS - command line arguments to pass to automake flags

# CONFIGURE_FLAGS - command line arguments to pass to configure

# GLIB_GETTEXTIZE_FLAGS - command line arguments to pass to glib-gettextize

# INTLTOOLIZE_FLAGS - command line arguments to pass to intltoolize

# LIBTOOLIZE_FLAGS - command line arguments to pass to libtoolize

# Other helpful notes:

# If you're using a different c compiler, you can override the environment

# variable in 'autogen.args'. For example, say you're using distcc, just add

# the following to 'autogen.args':

# CC="distcc"

# This will work for any influential environment variable to configure.

###############################################################################

PACKAGE="Pidgin"

ARGS_FILE="autogen.args"

export CFLAGS

export LDFLAGS

libtoolize="libtoolize"

case $(uname -s) in

Darwin*)

libtoolize="glibtoolize"

;;

esac

###############################################################################

# Some helper functions

###############################################################################

check () {

CMD=$1

printf "%s" "checking for ${CMD}... "

BIN=`which ${CMD} 2>/dev/null`

if [ x"${BIN}" = x"" ] ; then

echo "not found."

echo "${CMD} is required to build ${PACKAGE}!"

exit 1;

echo "${BIN}"

}

run_or_die () { # beotch

CMD=$1

shift

OUTPUT=`mktemp autogen-XXXXXX`

printf "running %s %s... " ${CMD} "$*"

${CMD} ${@} >${OUTPUT} 2>&1

if [ $? != 0 ] ; then

echo "failed."

cat ${OUTPUT}

rm -f ${OUTPUT}

exit 1

else

echo "done."

cat ${OUTPUT}

rm -f ${OUTPUT}

}

cleanup () {

rm -f autogen-??????

echo

exit 2

}

###############################################################################

# We really start here, yes, very sneaky!

###############################################################################

trap cleanup 2

FIGLET=`which figlet 2> /dev/null`

if [ x"${FIGLET}" != x"" ] ; then

${FIGLET} -f small ${PACKAGE}

echo "build system is being generated"

else

echo "autogenerating build system for '${PACKAGE}'"

###############################################################################

# Look for our args file

###############################################################################

printf "%s" "checking for ${ARGS_FILE}: "

if [ -f ${ARGS_FILE} ] ; then

echo "found."

printf "%s" "sourcing ${ARGS_FILE}: "

. "`dirname "$0"`"/${ARGS_FILE}

echo "done."

else

echo "not found."

###############################################################################

# Check for our required helpers

###############################################################################

check "$libtoolize"; LIBTOOLIZE=${BIN};

check "glib-gettextize"; GLIB_GETTEXTIZE=${BIN};

check "intltoolize"; INTLTOOLIZE=${BIN};

check "sed"; SED=${BIN};

check "aclocal"; ACLOCAL=${BIN};

check "autoheader"; AUTOHEADER=${BIN};

check "automake"; AUTOMAKE=${BIN};

check "autoconf"; AUTOCONF=${BIN};

###############################################################################

# Run all of our helpers

###############################################################################

run_or_die ${LIBTOOLIZE} ${LIBTOOLIZE_FLAGS:-"-c -f --automake"}

run_or_die ${GLIB_GETTEXTIZE} ${GLIB_GETTEXTIZE_FLAGS:-"--force --copy"}

run_or_die ${INTLTOOLIZE} ${INTLTOOLIZE_FLAGS:-"-c -f --automake"}

# This call to sed is needed to work around an annoying bug in intltool 0.40.6

# See http://developer.pidgin.im/ticket/9520 for details

run_or_die ${SED} -i.bak -e "s:'\^\$\$lang\$\$':\^\$\$lang\$\$:g" po/Makefile.in.in

run_or_die ${ACLOCAL} ${ACLOCAL_FLAGS:-"-I m4macros"}

run_or_die ${AUTOHEADER} ${AUTOHEADER_FLAGS}

run_or_die ${AUTOMAKE} ${AUTOMAKE_FLAGS:-"-a -c --gnu"}

run_or_die ${AUTOCONF} ${AUTOCONF_FLAGS}

###############################################################################

# Run configure

###############################################################################

echo "running ./configure ${CONFIGURE_FLAGS} $@"

./configure ${CONFIGURE_FLAGS} $@

pidgin/pidgin