Re: [Bug debuginfod/28034] client-side %-escape url characters

[Noah Sanci <nsanci@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1382 bytes --]

Hello,

Here is an updated patch, using memmove. Much smaller.

Thanks for the suggestions,

Noah Sanci


On Thu, Aug 26, 2021 at 5:02 PM Frank Ch. Eigler <fche@redhat.com> wrote:
>
> Hi -
>
> >            /* PR28034 escape characters in completed url to %hh format. */
> > -          char *escaped_string;
> > -          escaped_string = curl_easy_escape(data[i].handle, filename, 0);
> > -          if (!escaped_string)
> > +          char escaped_string[PATH_MAX] = {'\0'};
> > +          char *loc = (char *) filename;
> > +          char *loc2;
> > +          char *tmp;
> > +          for(size_t j = 0; j < strlen(filename); ++j)
> >              {
> > -              rc = -ENOMEM;
> > -              goto out2;
> > +              loc2 = strstr(loc, "/");
> > +              // If the first character is a '/'
> > [...]
>
> Holy cow that's a lot of work to do it this way.
> A couple of alternatives:
>
> - ditch curl_easy_escape :-( and use a
>   malloc(strlen(x)*3)
>   byte-by-byte copy from source string into destination
>     if not [a-zA-Z0-9/.~] then %-escape
>
> or:
> - keep curl_easy_escape and postprocess
>   byte-by-byte examine the result of curl_easy_escape
>   - if seeing a "%2F", replace the % with a / and memmove the
>     rest of the string 2 bytes ahead
>
> It shouldn't need strtok or strstr or a lot of logic or stuff like
> that really.
>
> - FChE
>

[-- Attachment #2: 0001-debuginfod-PR28034-client-side-escape-url-characters.patch --]
[-- Type: text/x-patch, Size: 2407 bytes --]

From de7e50955dba711aeee33196bf2bfea3c47696f7 Mon Sep 17 00:00:00 2001
From: Noah Sanci <nsanci@redhat.com>
Date: Fri, 16 Jul 2021 15:16:20 -0400
Subject: [PATCH] debuginfod: PR28034 - client-side %-escape url characters

When requesting some source files, some URL-inconvenient chars
sometimes pop up.  Example from f33 libstdc++:
/buildid/44d8485cb75512c2ca5c8f70afbd475cae30af4f/source/usr/src/debug/
gcc-10.3.1-1.fc33.x86_64/obj-x86_64-redhat-linux/x86_64-redhat-linux/
libstdc++-v3/src/c++11/../../../../../libstdc++-v3/src/c++11/
condition_variable.cc
As this URL is passed into debuginfod's handler_cb, it appears that the
+ signs are helpfully unescaped to spaces by libmicrohttpd, which
'course breaks everything.
In order to ensure the server properly parses urls such as this one,
%-escape characters on the client side so that the correct url
is preserved and properly processed on the server side.

https://sourceware.org/bugzilla/show_bug.cgi?id=28034

Signed-off-by: Noah Sanci <nsanci@redhat.com>
---
 debuginfod/debuginfod-client.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/debuginfod/debuginfod-client.c b/debuginfod/debuginfod-client.c
index 7d4b220f..eb49b583 100644
--- a/debuginfod/debuginfod-client.c
+++ b/debuginfod/debuginfod-client.c
@@ -905,13 +905,25 @@ debuginfod_query_server (debuginfod_client *c,
         {
           /* PR28034 escape characters in completed url to %hh format. */
           char *escaped_string;
+          char *loc;
           escaped_string = curl_easy_escape(data[i].handle, filename, 0);
           if (!escaped_string)
             {
               rc = -ENOMEM;
               goto out2;
             }
-          snprintf(data[i].url, PATH_MAX, "%s/%s/%s/%s", server_url,
+
+          loc = strstr(escaped_string, "%2F");
+          if (loc != NULL)
+            do
+              {
+                loc[0] = '/';
+                // pull the string back after replacement
+                memmove(loc+1,loc+3,strlen(loc+3));
+                escaped_string[strlen(escaped_string) - 1] = '\0';
+                escaped_string[strlen(escaped_string) - 1] = '\0';
+              } while( (loc = strstr(loc, "%2F")) );
+          snprintf(data[i].url, PATH_MAX, "%s/%s/%s%s", server_url,
                    build_id_bytes, type, escaped_string);
           curl_free(escaped_string);
         }
-- 
2.31.1