fix: Allow to access path inside manifest that contains spaces#1008
fix: Allow to access path inside manifest that contains spaces#1008speeddragon wants to merge 2 commits into
Conversation
| {resolve, Subpath} -> {resolve, Subpath}; | ||
| Part -> | ||
| case part([$&, $~, $+, $ , $=], Part) of | ||
| case part([$&, $~, $+, $=], Part) of |
There was a problem hiding this comment.
This was here because upstream +s were coming out as somehow. Please can you check rigorously that the + still works from browsers etc?
There was a problem hiding this comment.
Is the use case + only for type definition? Eg to+integer=3. I will try to understand how + can be used outside of this example.
There was a problem hiding this comment.
I've added a test to check + inside a key value (key=8+8 to be "8 8")
I think after this PR, the failing cases are:
- Literal + in path segments: still potentially unsafe because + is syntax.
+in query keys: intentionally supported for typed params, but can collide with literal-space query keys.
There was a problem hiding this comment.
Literal + in path segments: still potentially unsafe because + is syntax.
This is 100% right. The + is syntax in path parts. Hard to see how we could build a non-weird, low WTFs/min scheme that supported both +type and +other stuff.
But isn't the problem upstream? Why were some paths coming with space becoming +? Or the answer is that 'whatever it was, it doesn't any more'?
There was a problem hiding this comment.
Browsers convert a plus sign (+) to a space when decoding data submitted through an HTML form with the standard application/x-www-form-urlencoded content type.
So if the page is serving a form, the value of that form will generate + instead of a space when sending the data via a GET request.
But looks like everything works as before (convert to a type, like test typed_key_test), and this just affects the split of the value inside a key.
2 participants
Accessing https://arweave.net/jD52P9VXPR_-o_VwLOu_zkfvc7VM1shmXZBS-MMddmo/Hora%20Bora%20cover.png returns 404 because the
Hora%20Bora%20cover.pngpart gets splited toHoraand only then is checked in the path.