Decode url before checking for question mark (#15422)
* decode url before checking for question mark * use only buffer * dont populate url_query_string_decoded when no question mark
Emmanuel Vasilakis committed
Jul 18, 2023 at 14:33 UTC
a8055794b948f996d0f327ce4390c52ba18bcf0b
1 file changed
+8
-14
web/server/web_client.c
+8
-14
@@ -2259,7 +2259,6 @@ ssize_t web_client_receive(struct web_client *w)
2259
return(bytes);
2260
}
2261
2262
-
2262
void web_client_decode_path_and_query_string(struct web_client *w, const char *path_and_query_string) {
2263
char buffer[NETDATA_WEB_REQUEST_URL_SIZE + 2];
2264
buffer[0] = '\0';
@@ -2281,29 +2280,24 @@ void web_client_decode_path_and_query_string(struct web_client *w, const char *p
2280
}
2281
else {
2282
// in non-stream mode, there is a path
2284
-
2283
// FIXME - the way this is implemented, query string params never accept the symbol &, not even encoded as %26
2284
// To support the symbol & in query string params, we need to turn the url_query_string_decoded into a
2285
// dictionary and decode each of the parameters individually.
2286
// OR: in url_query_string_decoded use as separator a control character that cannot appear in the URL.
2287
2290
- char *question_mark_start = strchr(path_and_query_string, '?');
2291
- if (question_mark_start)
2292
- url_decode_r(buffer, question_mark_start, NETDATA_WEB_REQUEST_URL_SIZE + 1);
2293
-
2294
- buffer[NETDATA_WEB_REQUEST_URL_SIZE + 1] = '\0';
2295
- buffer_strcat(w->url_query_string_decoded, buffer);
2288
+ url_decode_r(buffer, path_and_query_string, NETDATA_WEB_REQUEST_URL_SIZE + 1);
2289
2290
+ char *question_mark_start = strchr(buffer, '?');
2291
if (question_mark_start) {
2292
+ buffer_strcat(w->url_query_string_decoded, question_mark_start);
2293
char c = *question_mark_start;
2294
*question_mark_start = '\0';
2300
- url_decode_r(buffer, path_and_query_string, NETDATA_WEB_REQUEST_URL_SIZE + 1);
2295
+ buffer_strcat(w->url_path_decoded, buffer);
2296
*question_mark_start = c;
2302
- } else
2303
- url_decode_r(buffer, path_and_query_string, NETDATA_WEB_REQUEST_URL_SIZE + 1);
2304
-
2305
- buffer[NETDATA_WEB_REQUEST_URL_SIZE + 1] = '\0';
2306
- buffer_strcat(w->url_path_decoded, buffer);
2297
+ } else {
2298
+ buffer_strcat(w->url_query_string_decoded, "");
2299
+ buffer_strcat(w->url_path_decoded, buffer);
2300
+ }
2301
}
2302
}
2303