Re: [Bug-wget] Bug in processing url query arguments that have '/'

[Peng Yu]

On Sun, Aug 7, 2011 at 6:14 AM, Giuseppe Scrivano <address@hidden> wrote:
> Hello Peng,
>
> AFAICS, `s' is a path, so '/' in the query string is escaped and
> `acceptable' doesn't see it.
>
> As for your example:
>
> http://xxx.org/somescript?arg1=/xxy
>
> `s' in this case will be something like:
>
> xxx.org/somescript?arg1=%2Fxxy
>
> Do you have any example where it doesn't work?

Hi Giuseppe,

I was looking at the patched version. (See the patch posted in bug
#31147) So I think that the bug in the patch (see the relevant code
below, where full_file has the query string). I guess for full_file a
different 'acceptable' function should be used.

  if (opt.match_query_string) full_file = concat_strings(u->file, "?",
u->query, (char *) 0);

  if (!acceptable (full_file))
    {
    DEBUGP (("%s (%s) does not match acc/rej rules.\n",
          url, full_file));
    goto out;
    }
  }



> Peng Yu <address@hidden> writes:
>
>> Hi,
>>
>> The following line is in utils.c.
>>
>> # in acceptable (const char *s)
>>
>>   while (l && s[l] != '/')
>>     --l;
>>   if (s[l] == '/')
>>     s += (l + 1);
>>
>> It essentially gets a substring after the last '/'. However, when a
>> query has '/', this is problematic. For example, the above code snip
>> will extract '/xxy' instead of 'somescript?arg1=/xxy'. I think that
>> the above code should add the test of the position of '?'. If there is
>> a '?', it should look for the last '/' before '?'. Is it the case?
>>
>> http://xxx.org/somescript?arg1=/xxy
>



-- 
Regards,
Peng