AdaCore / AdaCore/aws

improper URL-decoding in AWS.Client

Open
#383 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Ada
Stars
162
Forks
45
PR merge metrics
No merged PRs in 30d

Description

When a properly percent-encoded URL is passed to AWS.Client.Get, the path and the query are decoded before the request is sent to the server. This can result in an invalid request and a 400 response. Any bytes that aren't allowed in a URL must be percent-encoded in the HTTP request. To send a valid request I have to escape the percent signs with a second round of percent-encoding before I pass the URL to Get, which is quite wrong.

It would make more sense for AWS.Client to do the opposite – to percent-encode instead of decoding. It would then accept an IRI in a known character encoding and convert it into a URL before sending, using the method specified in RFC 3987.

As long as AWS.Client doesn't handle IRIs, conversion from IRI to URL falls to the program using it. That conversion involves percent-encoding, and it's wrong for AWS.Client to undo it.

If it is necessary to decode percent-encoding while parsing the URL, then the path and query must be re-encoded before they're incorporated in the request. Such a roundtrip must be programmed with great care to avoid mangling the URL like in bug 382, so it's better to avoid the roundtrip.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at AWS.Client.Get and reproduce the handling of a properly percent-encoded URL, checking the path and query sent to the server. Compare the behavior with the URL and IRI requirements described in RFC 3987; done means valid percent-encoded requests are sent without requiring a second escaping pass.

Written by the indexing model from the issue text.

Assessment

Domain
api
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.