pidgin/pidgin

Stop using g_uri_escape_string() to escape the URI before launching it.
release-2.x.y
2014-01-13, Mark Doliner
41e1147347a5
Stop using g_uri_escape_string() to escape the URI before launching it.

This was wrong. Take this URL as an example:
https://developer.pidgin.im/search?q=brains&noquickjump=1&wiki=on

When escaped with g_uri_escape_string() it becomes:
https://developer.pidgin.im/search%3Fq%3Dbrains%26noquickjump%3D1%26wiki%3Don

?, = and & are replaced with %3F, %3D and %26 which means they are considered part of the path component rather than query args. I tested and I get 404s when launching that URL with Firefox, Google Chrome, and these manual commands: gnome-open, xdg-open, firefox, google-chrome.

Strangely I DON'T get a 404 when I launch the URL with Konqueror. The original unescaped URL loads. I consider this to be a bug in Konqueror. They would fail to load when launched with a URL that has a question mark as part of the path component because they would convert the remaining path into the query string.

So I ripped out uri_escaped and used uri in its place everywhere.

This bug never got released. We changed the behavior because someone reported
to us that this URL:
http://example.org/$(xterm)
caused xterm to be executed on his system. Obviously that's bad if that
happens, but I don't think it's a bug in Pidgin. We're correctly escaping
all arguments that we pass to the browser command. If a system unescapes those
at some point and execs them, then that system is dangerously broken.

I tested this newest code with Firefox, Google Chrome, Konqueror, and the
manual commands gnome-open and xdg-open and they all work perfectly for me.
# This program takes a C header/source as the input and produces
#
# with --keyword=enum: the list of all enums
# with --keyword=struct: the list of all structs
#
# the output styles:
#
# --enum DBUS_POINTER_NAME1,
# DBUS_POINTER_NAME2,
# DBUS_POINTER_NAME3,
#
# --list NAME1
# NAME2
# NAME3
#
from __future__ import print_function
import re
import sys
options = {}
def toprint(match, line):
if verbatim:
return line
else:
return pattern % match
for arg in sys.argv[1:]:
if arg[0:2] == "--":
mylist = arg[2:].split("=",1)
command = mylist[0]
if len(mylist) > 1:
options[command] = mylist[1]
else:
options[command] = None
keyword = options.get("keyword", "struct")
pattern = options.get("pattern", "%s")
verbatim = "verbatim" in options
structregexp1 = re.compile(r"^(typedef\s+)?%s\s+\w+\s+(\w+)\s*;" % keyword)
structregexp2 = re.compile(r"^(typedef\s+)?%s" % keyword)
structregexp3 = re.compile(r"^}\s+(\w+)\s*;")
print("/* Generated by %s. Do not edit! */" % sys.argv[0])
myinput = iter(sys.stdin)
for line in myinput:
match = structregexp1.match(line)
if match is not None:
print(toprint(match.group(2), line))
continue
match = structregexp2.match(line)
if match is not None:
while True:
if verbatim:
print(line.rstrip())
line = next(myinput)
match = structregexp3.match(line)
if match is not None:
print(toprint(match.group(1), line))
break
if line[0] not in [" ", "\t", "{", "\n"]:
if verbatim:
print(line)
break