HGKeeper

Stop using g_uri_escape_string() to escape the URI before launching it.
release-2.x.y
2014-01-13, Mark Doliner

41e1147347a5

Stop using g_uri_escape_string() to escape the URI before launching it.

This was wrong. Take this URL as an example:
https://developer.pidgin.im/search?q=brains&noquickjump=1&wiki=on

When escaped with g_uri_escape_string() it becomes:
https://developer.pidgin.im/search%3Fq%3Dbrains%26noquickjump%3D1%26wiki%3Don

?, = and & are replaced with %3F, %3D and %26 which means they are considered part of the path component rather than query args. I tested and I get 404s when launching that URL with Firefox, Google Chrome, and these manual commands: gnome-open, xdg-open, firefox, google-chrome.

Strangely I DON'T get a 404 when I launch the URL with Konqueror. The original unescaped URL loads. I consider this to be a bug in Konqueror. They would fail to load when launched with a URL that has a question mark as part of the path component because they would convert the remaining path into the query string.

So I ripped out uri_escaped and used uri in its place everywhere.

This bug never got released. We changed the behavior because someone reported
to us that this URL:
http://example.org/$(xterm)
caused xterm to be executed on his system. Obviously that's bad if that
happens, but I don't think it's a bug in Pidgin. We're correctly escaping
all arguments that we pass to the browser command. If a system unescapes those
at some point and execs them, then that system is dangerously broken.

I tested this newest code with Firefox, Google Chrome, Konqueror, and the
manual commands gnome-open and xdg-open and they all work perfectly for me.

* System tray icon (aka docklet) plugin for Purple

* Inspired by a similar plugin by:

* John (J5) Palmieri <johnp@martianrock.com>

* This program is free software; you can redistribute it and/or

* modify it under the terms of the GNU General Public License as

* published by the Free Software Foundation; either version 2 of the

* License, or (at your option) any later version.

* This program is distributed in the hope that it will be useful, but

* WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

* General Public License for more details.

* You should have received a copy of the GNU General Public License

* along with this program; if not, write to the Free Software

* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA

* 02111-1301, USA.

#ifndef _GTKDOCKLET_H_

#define _GTKDOCKLET_H_

#include "status.h"

struct docklet_ui_ops

{

void (*create)(void);

void (*destroy)(void);

void (*update_icon)(PurpleStatusPrimitive, gboolean, gboolean);

void (*blank_icon)(void);

void (*set_tooltip)(gchar *);

GtkMenuPositionFunc position_menu;

};

/* functions in gtkdocklet.c */

void pidgin_docklet_update_icon(void);

void pidgin_docklet_clicked(int);

void pidgin_docklet_embedded(void);

void pidgin_docklet_remove(void);

void pidgin_docklet_set_ui_ops(struct docklet_ui_ops *);

void pidgin_docklet_unload(void);

void pidgin_docklet_init(void);

void pidgin_docklet_uninit(void);

void*pidgin_docklet_get_handle(void);

/* function in gtkdocklet-{gtk,x11,win32}.c */

void docklet_ui_init(void);

#endif /* _GTKDOCKLET_H_ */

pidgin/pidgin