Skip to content

Commit

Permalink
Fix URL escape issues by escaping on URI parse error only
Browse files Browse the repository at this point in the history
Fixes #2456, Closes #2457, Fixes #2472, Closes #2473, Fixes #2505, Fixes #2517, Closes #2518
  • Loading branch information
mshibuya committed Jan 17, 2021
1 parent c655c17 commit 3faf749
Show file tree
Hide file tree
Showing 2 changed files with 21 additions and 3 deletions.
10 changes: 7 additions & 3 deletions lib/carrierwave/downloader/base.rb
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ def download(url, remote_headers = {})
end

##
# Processes the given URL by parsing and escaping it. Public to allow overriding.
# Processes the given URL by parsing it, and escaping if necessary. Public to allow overriding.
#
# === Parameters
#
Expand All @@ -40,8 +40,12 @@ def download(url, remote_headers = {})
def process_uri(uri)
uri_parts = uri.split('?')
encoded_uri = Addressable::URI.parse(uri_parts.shift).normalize.to_s
encoded_uri << '?' << Addressable::URI.encode(uri_parts.join('?')).gsub('%5B', '[').gsub('%5D', ']') if uri_parts.any?
URI.parse(encoded_uri)
query = uri_parts.any? ? "?#{uri_parts.join('?')}" : ''
begin
URI.parse("#{encoded_uri}#{query}")
rescue URI::InvalidURIError
URI.parse("#{encoded_uri}#{URI::DEFAULT_PARSER.escape(query)}")
end
rescue URI::InvalidURIError, Addressable::URI::InvalidURIError
raise CarrierWave::DownloadError, "couldn't parse URL: #{uri}"
end
Expand Down
14 changes: 14 additions & 0 deletions spec/downloader/base_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -159,6 +159,20 @@
expect(processed.to_s).to eq('http://example.com/%5D.jpg?test[]')
end

it "escapes and parse unescaped characters in path" do
uri = 'http://example.com/あああ.jpg'
processed = subject.process_uri(uri)
expect(processed.class).to eq(URI::HTTP)
expect(processed.to_s).to eq('http://example.com/%E3%81%82%E3%81%82%E3%81%82.jpg')
end

it "escapes and parse unescaped characters in query string" do
uri = 'http://example.com/?q=あああ'
processed = subject.process_uri(uri)
expect(processed.class).to eq(URI::HTTP)
expect(processed.to_s).to eq('http://example.com/?q=%E3%81%82%E3%81%82%E3%81%82')
end

it "throws an exception on bad uris" do
uri = '~http:'
expect { subject.process_uri(uri) }.to raise_error(CarrierWave::DownloadError)
Expand Down

0 comments on commit 3faf749

Please sign in to comment.