Skip to content

Commit

Permalink
Ruby: Avoid double escaping path items (#3093)
Browse files Browse the repository at this point in the history
`URI.encode` is obsolete. `CGI.escape`, `URI.encode_www_form` or
`URI.encode_www_form_component` are recommended instead.
https://ruby-doc.org/stdlib-2.6/libdoc/uri/rdoc/URI/Escape.html#method-i-escape

URI.encode has different behaviour to CGI.escape:

```ruby
URI.encode('hello/world?test%string')
=> "hello/world?test%25string"
CGI.escape('hello/world?test%string')
=> "hello%2Fworld%3Ftest%25string"
```

I recently raised pull request #3039
201cbdc

That pull request escapes path items at insertion.

Before either pull request, the path item 'hello?world' would go into
the URL as 'hello?world'. That behaviour was insecure as if an attacker
could control the path item value, they could change the URL the
application connected to.

After #3039 'hello?world' would go in as 'hello%253Fworld'. This was
safer than before, but it's still not correct.
If I'd realised at the time, I would have made it correct at the time.

What this pull request does is make it go in as 'hello%35world', which
is correct.

ApiClient::build_request_url was URI.encoding the whole path.
This wasn't protecting against all undesirable characters in the path
items, but was escaping % characters a 2nd time which was unhelpful.

I have additionally removed URI.encode from Configuration::base_url as I
can't see any benefit it could be bringing.
There is no justification for it in the commit where it was originally
added: 47c8597
  • Loading branch information
ccouzens authored and autopp committed Jun 5, 2019
1 parent 66bf0dc commit 4e9d226
Show file tree
Hide file tree
Showing 20 changed files with 6 additions and 32 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@
{{> api_info}}
=end

require 'uri'
require 'cgi'

module {{moduleName}}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ require 'json'
require 'logger'
require 'tempfile'
require 'typhoeus'
require 'uri'

module {{moduleName}}
class ApiClient
Expand Down Expand Up @@ -256,7 +255,7 @@ module {{moduleName}}
def build_request_url(path)
# Add leading and trailing slashes to path
path = "/#{path}".gsub(/\/+/, '/')
URI.encode(@config.base_url + path)
@config.base_url + path
end

# Builds the HTTP request body
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,6 @@
{{> api_info}}
=end

require 'uri'

module {{moduleName}}
class Configuration
# Defines url scheme
Expand Down Expand Up @@ -166,8 +164,7 @@ module {{moduleName}}
end

def base_url
url = "#{scheme}://#{[host, base_path].join('/').gsub(/\/+/, '/')}".sub(/\/+\z/, '')
URI.encode(url)
"#{scheme}://#{[host, base_path].join('/').gsub(/\/+/, '/')}".sub(/\/+\z/, '')
end

# Gets API key (with prefix if set).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
=end

require 'uri'
require 'cgi'

module Petstore
Expand Down
1 change: 0 additions & 1 deletion samples/client/petstore/ruby/lib/petstore/api/fake_api.rb
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
=end

require 'uri'
require 'cgi'

module Petstore
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
=end

require 'uri'
require 'cgi'

module Petstore
Expand Down
1 change: 0 additions & 1 deletion samples/client/petstore/ruby/lib/petstore/api/pet_api.rb
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
=end

require 'uri'
require 'cgi'

module Petstore
Expand Down
1 change: 0 additions & 1 deletion samples/client/petstore/ruby/lib/petstore/api/store_api.rb
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
=end

require 'uri'
require 'cgi'

module Petstore
Expand Down
1 change: 0 additions & 1 deletion samples/client/petstore/ruby/lib/petstore/api/user_api.rb
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
=end

require 'uri'
require 'cgi'

module Petstore
Expand Down
3 changes: 1 addition & 2 deletions samples/client/petstore/ruby/lib/petstore/api_client.rb
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@
require 'logger'
require 'tempfile'
require 'typhoeus'
require 'uri'

module Petstore
class ApiClient
Expand Down Expand Up @@ -262,7 +261,7 @@ def sanitize_filename(filename)
def build_request_url(path)
# Add leading and trailing slashes to path
path = "/#{path}".gsub(/\/+/, '/')
URI.encode(@config.base_url + path)
@config.base_url + path
end

# Builds the HTTP request body
Expand Down
5 changes: 1 addition & 4 deletions samples/client/petstore/ruby/lib/petstore/configuration.rb
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,6 @@
=end

require 'uri'

module Petstore
class Configuration
# Defines url scheme
Expand Down Expand Up @@ -174,8 +172,7 @@ def base_path=(base_path)
end

def base_url
url = "#{scheme}://#{[host, base_path].join('/').gsub(/\/+/, '/')}".sub(/\/+\z/, '')
URI.encode(url)
"#{scheme}://#{[host, base_path].join('/').gsub(/\/+/, '/')}".sub(/\/+\z/, '')
end

# Gets API key (with prefix if set).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
=end

require 'uri'
require 'cgi'

module Petstore
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
=end

require 'uri'
require 'cgi'

module Petstore
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
=end

require 'uri'
require 'cgi'

module Petstore
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
=end

require 'uri'
require 'cgi'

module Petstore
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
=end

require 'uri'
require 'cgi'

module Petstore
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
=end

require 'uri'
require 'cgi'

module Petstore
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@
=end

require 'uri'
require 'cgi'

module Petstore
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@
require 'logger'
require 'tempfile'
require 'typhoeus'
require 'uri'

module Petstore
class ApiClient
Expand Down Expand Up @@ -262,7 +261,7 @@ def sanitize_filename(filename)
def build_request_url(path)
# Add leading and trailing slashes to path
path = "/#{path}".gsub(/\/+/, '/')
URI.encode(@config.base_url + path)
@config.base_url + path
end

# Builds the HTTP request body
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,6 @@
=end

require 'uri'

module Petstore
class Configuration
# Defines url scheme
Expand Down Expand Up @@ -174,8 +172,7 @@ def base_path=(base_path)
end

def base_url
url = "#{scheme}://#{[host, base_path].join('/').gsub(/\/+/, '/')}".sub(/\/+\z/, '')
URI.encode(url)
"#{scheme}://#{[host, base_path].join('/').gsub(/\/+/, '/')}".sub(/\/+\z/, '')
end

# Gets API key (with prefix if set).
Expand Down

0 comments on commit 4e9d226

Please sign in to comment.