You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Problem
When reading a path parameter from a route, yew-router does not decode escaped characters in the path segment, and passes them to the user as they are in the URL string.
When navigating via Link, path parameters are not encoded, leading to issues when path components have spaces, forward slashes, and other forbidden characters in them.
Clicking the link navigates to Route::Search { query: "foo bar baz" }, whose handler just prints out the query. Clicking the URL goes to http://127.0.0.1:8080/search/foo bar baz which prints You searched for: foo%20bar%20baz.
Replacing the query with "foo/bar/baz" causes the link to go to http://127.0.0.1:8080/search/foo/bar/baz, which is an entirely different route.
Expected behavior
When creating a URL, yew-router should percent-encode characters forbidden in URL components. When parsing a route, yew-router should decode those percent-encoded characters before parsing.
Otherwise, it's quite unintuitive and inconvenient that Routes are not "round-trip safe", and that linking to one route may lead to a different route if the path parameters contain slashes. This may also introduce a url injection vulnerability.
Environment:
Yew version: 0.20.0 (yew-router version 0.17.0)
Rust version: 1.66.1
Target, if relevant: wasm32-unknown-unknown
Build tool, if relevant: trunk
OS, if relevant: Not relevant
Browser and version, if relevant: Not relevant
Questionnaire
I'm interested in fixing this myself but don't know where to start
I would like to fix and I have a solution
I don't have time to fix this right now, but maybe later
The text was updated successfully, but these errors were encountered:
@Jaffa-Cakes As the comments in that PR say, this only handles encoding. A fix for this issue would also need to decode the parameters when they are parsed.
Problem
When reading a path parameter from a route, yew-router does not decode escaped characters in the path segment, and passes them to the user as they are in the URL string.
When navigating via
Link
, path parameters are not encoded, leading to issues when path components have spaces, forward slashes, and other forbidden characters in them.Steps To Reproduce
Example application:
Clicking the link navigates to
Route::Search { query: "foo bar baz" }
, whose handler just prints out thequery
. Clicking the URL goes tohttp://127.0.0.1:8080/search/foo bar baz
which printsYou searched for: foo%20bar%20baz
.Replacing the query with
"foo/bar/baz"
causes the link to go tohttp://127.0.0.1:8080/search/foo/bar/baz
, which is an entirely different route.Expected behavior
When creating a URL, yew-router should percent-encode characters forbidden in URL components. When parsing a route, yew-router should decode those percent-encoded characters before parsing.
Otherwise, it's quite unintuitive and inconvenient that Routes are not "round-trip safe", and that linking to one route may lead to a different route if the path parameters contain slashes. This may also introduce a url injection vulnerability.
Environment:
Questionnaire
The text was updated successfully, but these errors were encountered: