From: Matthieu Moy <matthieu.moy@grenoble-inp.fr>
Date: Tue, 22 Jun 2010 11:34:42 GMT
Subject: Re: [PATCH] Do not decode url protocol.
Message-ID: <vpqiq5bb8rx.fsf@bauges.imag.fr>
In-Reply-To: <AANLkTinK99krA-16qUO8nWYbZ7w6o632jLTTW5WyaKOk@mail.gmail.com>

Matthieu Moy <Matthieu.Moy@grenoble-inp.fr> writes:

> Otherwise, the patch sounds good.

Humm, looking a bit closer ...

Pascal Obry <pascal@obry.net> writes:

> @@ -70,9 +70,18 @@ static int url_decode_char(const char *q)
>  static char *url_decode_internal(const char **query, const char *stop_at)
>  {

This function is called from multiple places :


char *url_decode(const char *url)
{
	return url_decode_internal(&url, NULL);
}

char *url_decode_parameter_name(const char **query)
{
	return url_decode_internal(query, "&=");
}

char *url_decode_parameter_value(const char **query)
{
	return url_decode_internal(query, "&");
}

I don't think you want to avoid escaping until the first slash in
url_decode_parameter_name and url_decode_parameter_value. I think you
want to patch url_decode, not url_decode_internal.

> +	/* Skip protocol. */
> +	first_slash = strchr(*query, '/');

Are you sure the URL contains a / at this point? That would be a user
error if it doesn't, but has this been validated (with a clean error
message if needed) earlier in the code?

-- 
Matthieu Moy
http://www-verimag.imag.fr/~moy/