From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) by sourceware.org (Postfix) with ESMTP id 2BB3C3858D3C for ; Thu, 26 Aug 2021 19:28:00 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 2BB3C3858D3C Received: from mail-il1-f198.google.com (mail-il1-f198.google.com [209.85.166.198]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-321-sWwYEvGUMuGVJrGRdTrqFA-1; Thu, 26 Aug 2021 15:27:57 -0400 X-MC-Unique: sWwYEvGUMuGVJrGRdTrqFA-1 Received: by mail-il1-f198.google.com with SMTP id c4-20020a056e020cc4b02902242bd90889so2603620ilj.20 for ; Thu, 26 Aug 2021 12:27:57 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=tccJu3q81dbuunJkMG8IeRLRyv4dOjeQJ25AU2A4u2o=; b=TcbmwDoRSZDfowM4muY11DGProOoP/7JflNrzrDvknNZa33BGfiiPkJ4UqVrQuCvyU fWMOUn5fTX0n8dXqrz1YxlAZULfKKXk+/MuwVKE0iIh1765RfwuL9HMKas9MFymKCJCG fkMJp2EfmBXhJu7LJdWN+B2pCEZEe9BZOKVc5rRGFqVph16Up02e3YQejABfEBmwQ+fm 2OuWZPM4NoJLt13MsOMpJSxets76hWGZa06k/A566kWnWxzJtOan7nL+zqLO2AYLhohV Fg31CjQ8W8cLBLzbA3o2mZcRzo5WWH0jprIX4ZGmaVOEnndiNQ+bU5eadPocV9z0wv+R xafA== X-Gm-Message-State: AOAM53168xluHKsGcasYmzNNpXjUSvymMek5twCUtCdG3OEFW9lfKlbz 9VsFPHibBvOz46tNHKcdQAB1S+EPOkaU3iq/aKKF0AhBtu4wUcV+sl4yLjTHEU2lFI8T9rH+GbH Pqv9kZlAkyB1k3O7aFUbB371xg+ikBcYzxA/Rk68dqg== X-Received: by 2002:a6b:f40a:: with SMTP id i10mr4335605iog.139.1630006076823; Thu, 26 Aug 2021 12:27:56 -0700 (PDT) X-Google-Smtp-Source: ABdhPJz1Ny20TqAUjLMCf7k8d7GdCWy1MKR7rCuUjF2cJHhPH6hEIXqoKL4b6Z3ywhKk2UFpA3wvwTzK8XUlCqCj1aE= X-Received: by 2002:a6b:f40a:: with SMTP id i10mr4335600iog.139.1630006076598; Thu, 26 Aug 2021 12:27:56 -0700 (PDT) MIME-Version: 1.0 From: Noah Sanci Date: Thu, 26 Aug 2021 15:27:45 -0400 Message-ID: Subject: [Bug debuginfod/28034] client-side %-escape url characters To: elfutils-devel@sourceware.org X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: multipart/mixed; boundary="0000000000002d9f3f05ca7b5d62" X-Spam-Status: No, score=-13.7 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: elfutils-devel@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Elfutils-devel mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Aug 2021 19:28:10 -0000 --0000000000002d9f3f05ca7b5d62 Content-Type: text/plain; charset="UTF-8" Hello, When requesting some source files, some URL-inconvenient chars sometimes pop up. Example from f33 libstdc++: /buildid/44d8485cb75512c2ca5c8f70afbd475cae30af4f/source/usr/src/debug/ gcc-10.3.1-1.fc33.x86_64/obj-x86_64-redhat-linux/x86_64-redhat-linux/ libstdc++-v3/src/c++11/../../../../../libstdc++-v3/src/c++11/ condition_variable.cc As this URL is passed into debuginfod's handler_cb, it appears that the + signs are helpfully unescaped to spaces by libmicrohttpd, which 'course breaks everything. In order to ensure the server properly parses urls such as this one, %-escape characters on the client side so that the correct url is preserved and properly processed on the server side. This patch preserves '/'s in the url. Please find the patch attached. -Noah Sanci --0000000000002d9f3f05ca7b5d62 Content-Type: text/x-patch; charset="US-ASCII"; name="0001-debuginfod-PR28034-client-side-escape-url-characters.patch" Content-Disposition: attachment; filename="0001-debuginfod-PR28034-client-side-escape-url-characters.patch" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_kstbhyv10 RnJvbSAwYmMwZjNmMDRiMWMwNThmZTg0OTViZDc2Yzk2MmVjOWQzYzkwMWRkIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBOb2FoIFNhbmNpIDxuc2FuY2lAcmVkaGF0LmNvbT4KRGF0ZTog RnJpLCAxNiBKdWwgMjAyMSAxNToxNjoyMCAtMDQwMApTdWJqZWN0OiBbUEFUQ0hdIGRlYnVnaW5m b2Q6IFBSMjgwMzQgLSBjbGllbnQtc2lkZSAlLWVzY2FwZSB1cmwgY2hhcmFjdGVycwoKV2hlbiBy ZXF1ZXN0aW5nIHNvbWUgc291cmNlIGZpbGVzLCBzb21lIFVSTC1pbmNvbnZlbmllbnQgY2hhcnMK c29tZXRpbWVzIHBvcCB1cC4gIEV4YW1wbGUgZnJvbSBmMzMgbGlic3RkYysrOgovYnVpbGRpZC80 NGQ4NDg1Y2I3NTUxMmMyY2E1YzhmNzBhZmJkNDc1Y2FlMzBhZjRmL3NvdXJjZS91c3Ivc3JjL2Rl YnVnLwpnY2MtMTAuMy4xLTEuZmMzMy54ODZfNjQvb2JqLXg4Nl82NC1yZWRoYXQtbGludXgveDg2 XzY0LXJlZGhhdC1saW51eC8KbGlic3RkYysrLXYzL3NyYy9jKysxMS8uLi8uLi8uLi8uLi8uLi9s aWJzdGRjKystdjMvc3JjL2MrKzExLwpjb25kaXRpb25fdmFyaWFibGUuY2MKQXMgdGhpcyBVUkwg aXMgcGFzc2VkIGludG8gZGVidWdpbmZvZCdzIGhhbmRsZXJfY2IsIGl0IGFwcGVhcnMgdGhhdCB0 aGUKKyBzaWducyBhcmUgaGVscGZ1bGx5IHVuZXNjYXBlZCB0byBzcGFjZXMgYnkgbGlibWljcm9o dHRwZCwgd2hpY2gKJ2NvdXJzZSBicmVha3MgZXZlcnl0aGluZy4KSW4gb3JkZXIgdG8gZW5zdXJl IHRoZSBzZXJ2ZXIgcHJvcGVybHkgcGFyc2VzIHVybHMgc3VjaCBhcyB0aGlzIG9uZSwKJS1lc2Nh cGUgY2hhcmFjdGVycyBvbiB0aGUgY2xpZW50IHNpZGUgc28gdGhhdCB0aGUgY29ycmVjdCB1cmwK aXMgcHJlc2VydmVkIGFuZCBwcm9wZXJseSBwcm9jZXNzZWQgb24gdGhlIHNlcnZlciBzaWRlLgoK aHR0cHM6Ly9zb3VyY2V3YXJlLm9yZy9idWd6aWxsYS9zaG93X2J1Zy5jZ2k/aWQ9MjgwMzQKClNp Z25lZC1vZmYtYnk6IE5vYWggU2FuY2kgPG5zYW5jaUByZWRoYXQuY29tPgotLS0KIGRlYnVnaW5m b2QvZGVidWdpbmZvZC1jbGllbnQuYyB8IDUyICsrKysrKysrKysrKysrKysrKysrKysrKysrKyst LS0tLS0KIDEgZmlsZSBjaGFuZ2VkLCA0NCBpbnNlcnRpb25zKCspLCA4IGRlbGV0aW9ucygtKQoK ZGlmZiAtLWdpdCBhL2RlYnVnaW5mb2QvZGVidWdpbmZvZC1jbGllbnQuYyBiL2RlYnVnaW5mb2Qv ZGVidWdpbmZvZC1jbGllbnQuYwppbmRleCA3ZDRiMjIwZi4uZWQ1OTQzZjMgMTAwNjQ0Ci0tLSBh L2RlYnVnaW5mb2QvZGVidWdpbmZvZC1jbGllbnQuYworKysgYi9kZWJ1Z2luZm9kL2RlYnVnaW5m b2QtY2xpZW50LmMKQEAgLTkwNCwxNiArOTA0LDUyIEBAIGRlYnVnaW5mb2RfcXVlcnlfc2VydmVy IChkZWJ1Z2luZm9kX2NsaWVudCAqYywKICAgICAgIGlmIChmaWxlbmFtZSkgLyogbXVzdCBzdGFy dCB3aXRoIC8gKi8KICAgICAgICAgewogICAgICAgICAgIC8qIFBSMjgwMzQgZXNjYXBlIGNoYXJh Y3RlcnMgaW4gY29tcGxldGVkIHVybCB0byAlaGggZm9ybWF0LiAqLwotICAgICAgICAgIGNoYXIg KmVzY2FwZWRfc3RyaW5nOwotICAgICAgICAgIGVzY2FwZWRfc3RyaW5nID0gY3VybF9lYXN5X2Vz Y2FwZShkYXRhW2ldLmhhbmRsZSwgZmlsZW5hbWUsIDApOwotICAgICAgICAgIGlmICghZXNjYXBl ZF9zdHJpbmcpCisgICAgICAgICAgY2hhciBlc2NhcGVkX3N0cmluZ1tQQVRIX01BWF0gPSB7J1ww J307CisgICAgICAgICAgY2hhciAqbG9jID0gKGNoYXIgKikgZmlsZW5hbWU7CisgICAgICAgICAg Y2hhciAqbG9jMjsKKyAgICAgICAgICBjaGFyICp0bXA7CisgICAgICAgICAgZm9yKHNpemVfdCBq ID0gMDsgaiA8IHN0cmxlbihmaWxlbmFtZSk7ICsraikKICAgICAgICAgICAgIHsKLSAgICAgICAg ICAgICAgcmMgPSAtRU5PTUVNOwotICAgICAgICAgICAgICBnb3RvIG91dDI7CisgICAgICAgICAg ICAgIGxvYzIgPSBzdHJzdHIobG9jLCAiLyIpOworICAgICAgICAgICAgICAvLyBJZiB0aGUgZmly c3QgY2hhcmFjdGVyIGlzIGEgJy8nCisgICAgICAgICAgICAgIGlmICggKHVuc2lnbmVkIGxvbmcp IGxvYzIgLSAodW5zaWduZWQgbG9uZykgbG9jIDw9IDApCisgICAgICAgICAgICAgICAgeworICAg ICAgICAgICAgICAgICAgc3RyY2F0KGVzY2FwZWRfc3RyaW5nLCAiLyIpOworICAgICAgICAgICAg ICAgICAgbG9jICsrOworICAgICAgICAgICAgICAgIH0KKyAgICAgICAgICAgICAgLy8gSWYgd2Ug aGF2ZSByZWFjaGVkIHRoZSBlbmQgb2YgdGhlIHBhdGgsIHRoZXJlIHdvbid0IGJlIGEgLworICAg ICAgICAgICAgICAvLyBidXQgd2Ugc3RpbGwgbmVlZCB0byBwcm9jZXNzIG9uZSBtb3JlIHN0cmlu ZyAodGhlIGZpbGUncyBhY3R1YWwgbmFtZSkKKyAgICAgICAgICAgICAgZWxzZSBpZiAobG9jMiA9 PSBOVUxMKQorICAgICAgICAgICAgICAgIHsKKyAgICAgICAgICAgICAgICAgIHRtcCA9IGN1cmxf ZWFzeV9lc2NhcGUoZGF0YVtpXS5oYW5kbGUsIGxvYywgMCk7CisgICAgICAgICAgICAgICAgICBp ZiAoIXRtcCkKKyAgICAgICAgICAgICAgICAgICAgeworICAgICAgICAgICAgICAgICAgICAgIHJj ID0gLUVOT01FTTsKKyAgICAgICAgICAgICAgICAgICAgICBnb3RvIG91dDE7CisgICAgICAgICAg ICAgICAgICAgIH0KKyAgICAgICAgICAgICAgICAgIHN0cmNhdChlc2NhcGVkX3N0cmluZywgdG1w KTsKKyAgICAgICAgICAgICAgICAgIGN1cmxfZnJlZSh0bXApOworICAgICAgICAgICAgICAgICAg YnJlYWs7CisgICAgICAgICAgICAgICAgfQorICAgICAgICAgICAgICAvLyBUaGUgZGVmYXVsdCBj YXNlLCB3aGVuIHRoZXJlIGlzIGEgc3RyaW5nIHN1cnJvdW5kZWQgYnkgJy8ncworICAgICAgICAg ICAgICBlbHNlCisgICAgICAgICAgICAgICAgeworICAgICAgICAgICAgICAgICAgLy8gVGhlIHRo aXJkIGFyZ3VtZW50IHRvIGN1cmxfZWFzeV9lc2NhcGUgaXNvbGF0ZWQgdGhlIHN0cmluZyBiZXR3 ZWVuIHRoZQorICAgICAgICAgICAgICAgICAgLy8gJy8ncworICAgICAgICAgICAgICAgICAgdG1w ID0gY3VybF9lYXN5X2VzY2FwZShkYXRhW2ldLmhhbmRsZSwgbG9jLCAodW5zaWduZWQgbG9uZykg bG9jMiAtICh1bnNpZ25lZCBsb25nKWxvYyk7CisgICAgICAgICAgICAgICAgICBpZiAoIXRtcCkK KyAgICAgICAgICAgICAgICAgICAgeworICAgICAgICAgICAgICAgICAgICAgIHJjID0gLUVOT01F TTsKKyAgICAgICAgICAgICAgICAgICAgICBnb3RvIG91dDE7CisgICAgICAgICAgICAgICAgICAg IH0KKyAgICAgICAgICAgICAgICAgIHN0cmNhdChlc2NhcGVkX3N0cmluZywgdG1wKTsKKyAgICAg ICAgICAgICAgICAgIHN0cmNhdChlc2NhcGVkX3N0cmluZywgIi8iKTsKKyAgICAgICAgICAgICAg ICAgIGN1cmxfZnJlZSh0bXApOworICAgICAgICAgICAgICAgICAgbG9jID0gbG9jMisxOworICAg ICAgICAgICAgICAgIH0KICAgICAgICAgICAgIH0KLSAgICAgICAgICBzbnByaW50ZihkYXRhW2ld LnVybCwgUEFUSF9NQVgsICIlcy8lcy8lcy8lcyIsIHNlcnZlcl91cmwsCi0gICAgICAgICAgICAg ICAgICAgYnVpbGRfaWRfYnl0ZXMsIHR5cGUsIGVzY2FwZWRfc3RyaW5nKTsKLSAgICAgICAgICBj dXJsX2ZyZWUoZXNjYXBlZF9zdHJpbmcpOworICAgICAgICAgIHNucHJpbnRmKGRhdGFbaV0udXJs LCBQQVRIX01BWCwgIiVzLyVzLyVzJXMiLCBzZXJ2ZXJfdXJsLAorICAgICAgICAgICAgICAgICAg ICBidWlsZF9pZF9ieXRlcywgdHlwZSwgZXNjYXBlZF9zdHJpbmcpOwogICAgICAgICB9CiAgICAg ICBlbHNlCiAgICAgICAgIHNucHJpbnRmKGRhdGFbaV0udXJsLCBQQVRIX01BWCwgIiVzLyVzLyVz Iiwgc2VydmVyX3VybCwgYnVpbGRfaWRfYnl0ZXMsIHR5cGUpOwotLSAKMi4zMS4xCgo= --0000000000002d9f3f05ca7b5d62--