-
-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
net/gclient: fix parameters containing equal signs were tampered #3643
base: master
Are you sure you want to change the base?
Conversation
… with when there were file parameters in the same form.
@fghwett Good enhancement! Would you please add associated unit testing case for this update? |
…x parameters were tampered with in the form request parameters.
When I was writing the test case, I found a problem with more than just containing equal signs. After looking at the code, I decided it was the '@file:' parameter and noUrlEncode, so I made some adjustments. |
@fghwett or you can urlencode your parameters? like: g.Client().Post(
context.Background(),
"https://example.com",
"source=https%3A%2F%2Fexmaple.com%2Frand%3Ftype%3Dgirls%26image%3D%40file%3Afilename.png",
) |
I tried the following two ways and got wrong results. # Only the parameters other than the file are encoded, and the backend will receive the encoded URL. However, in terms of business logic, the backend does not perform URL de-encoding processing.
resp, err := gclient.New().
Post(context.Background(), "https://exmaple.com",
fmt.Sprintf("source=%s&image=@file:%s", gurl.Encode("https://exmaple.com/rand?type=girls"), "filepath.jpg"),
)
# Encode all parameters, gclient will think they are uploaded in json format.
resp, err := gclient.New().
Post(context.Background(), "https://example.com",
gurl.Encode("source=https://exmaple.com/rand?type=girls&image=@file:filename.jpg"),
) In the business logic, I need to upload a photo along with the original URL of the photo. |
@fghwett What you expect is the server side receiving the normal source parameter ( |
I'm the first case. |
I'm still handling on this. |
Fixed the issue where parameters containing equal signs were tampered with when there were file parameters in the same form.
Example: