go-chi / go-chi/chi

URL encoded route parameters not handle correctly

Open
#641 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
22.8k
Forks
1.2k
Avg merge
5h 17m
Merged PRs (30d)
10

Description

There was a fix put in (#148) a while ago that introduced use of url.RawPath as the basis for the route path.
However, as I understand it, RawPath is only a _hint_ and doesn't always include the actual URL encoded path. It only contains the path if it differs from the default encoding of the path. In other words, RawPath being blank doesn't mean that the path requires URL encoding, or that the path originally contained no URL encoded elements, just that the original path can be reconstructed from path.
The relevant code in url is:
```
// setPath sets the Path and RawPath fields of the URL based on the provided
// escaped path p. It maintains the invariant that RawPath is only specified
// when it differs from the default encoding of the path.
// For example:
// - setPath("/foo/bar") will set Path="/foo/bar" and RawPath=""
// - setPath("/foo%2fbar") will set Path="/foo/bar" and RawPath="/foo%2fbar"
// setPath will return an error only if the provided path contains an invalid
// escaping.
func (u *URL) setPath(p string) error {
path, err := unescape(p, encodePath)
if err != nil {
return err
}
u.Path = path
if escp := escape(path, encodePath); p == escp {
// Default encoding is fine.
u.RawPath = ""
} else {
u.RawPath = p
}
return nil
}
```

Note that the condition is not "does the path need escaping" but "does the original rawpath equal the escaped form of the path".

In other words, rather than consulting RawPath, I believe that the code should be consulting EscapedPath().

There is no particularly easy workaround to this. I can't decode the result from chi.URLParam, because it _might_ already be decoded, but might not.

This appears to be a bug in the fix supplied for #148, or rather that the fix didn't cater for all scenarios.

I'm happy to provide a PR for this if it's felt that this is a bug.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.