HGKeeper

Stop using g_uri_escape_string() to escape the URI before launching it.
release-2.x.y
2014-01-13, Mark Doliner

41e1147347a5

Stop using g_uri_escape_string() to escape the URI before launching it.

This was wrong. Take this URL as an example:
https://developer.pidgin.im/search?q=brains&noquickjump=1&wiki=on

When escaped with g_uri_escape_string() it becomes:
https://developer.pidgin.im/search%3Fq%3Dbrains%26noquickjump%3D1%26wiki%3Don

?, = and & are replaced with %3F, %3D and %26 which means they are considered part of the path component rather than query args. I tested and I get 404s when launching that URL with Firefox, Google Chrome, and these manual commands: gnome-open, xdg-open, firefox, google-chrome.

Strangely I DON'T get a 404 when I launch the URL with Konqueror. The original unescaped URL loads. I consider this to be a bug in Konqueror. They would fail to load when launched with a URL that has a question mark as part of the path component because they would convert the remaining path into the query string.

So I ripped out uri_escaped and used uri in its place everywhere.

This bug never got released. We changed the behavior because someone reported
to us that this URL:
http://example.org/$(xterm)
caused xterm to be executed on his system. Obviously that's bad if that
happens, but I don't think it's a bug in Pidgin. We're correctly escaping
all arguments that we pass to the browser command. If a system unescapes those
at some point and execs them, then that system is dangerously broken.

I tested this newest code with Firefox, Google Chrome, Konqueror, and the
manual commands gnome-open and xdg-open and they all work perfectly for me.

# This program takes a C source as the input and produces the list of

# all signals registered.

# Output is:

# <signal name="Changed">

# <arg name="new_value" type="b"/>

# </signal>

from __future__ import print_function

import re

import sys

# List "excluded" contains signals that shouldn't be exported via

# DBus. If you remove a signal from this list, please make sure

# that it does not break "make" with the configure option

# "--enable-dbus" turned on.

excluded = [\

# purple_dbus_signal_emit_purple prevents our "dbus-method-called"

# signal from being propagated to dbus.

"dbus-method-called",

]

registerregex = re.compile("purple_signal_register[^;]+\"([\w\-]+)\"[^;]+(purple_marshal_\w+)[^;]+;")

nameregex = re.compile('[-_][a-z]')

print("/* Generated by %s. Do not edit! */" % sys.argv[0])

print("const char *dbus_signals = ")

for match in registerregex.finditer(sys.stdin.read()):

signal = match.group(1)

marshal = match.group(2)

if signal in excluded:

continue

signal = nameregex.sub(lambda x:x.group()[1].upper(), '-'+signal)

print("\" <signal name='%s'>\\n\"" % signal)

args = marshal.split('_')

# ['purple', 'marshal', <return type>, '', args...]

if len(args) > 4:

for arg in args[4:]:

if arg == "POINTER":

type = 'p'

elif arg == "ENUM":

type = 'i'

elif arg == "INT":

type = 'i'

elif arg == "UINT":

type = 'u'

elif arg == "INT64":

type = 'x'

elif arg == "UINT64":

type = 't'

elif arg == "BOOLEAN":

type = 'b'

print("\" <arg type='%s'/>\\n\"" % type)

print("\" </signal>\\n\"")

print(";")

pidgin/pidgin