← Commit list

ae08995ed1

Rhino

2026-09-18

SUCCESS Duration: 404s

Subject

tool_ipfs: keep the path percent-encoded when rewriting to the gateway

Binary

No binary (build failed)

Architecture & Compiler Flags

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

Build Log

(log yok)

Commit Diff GitHub →

src/tool_ipfs.c +11 -5 tests/data/Makefile.am +2 -0 tests/data/test1691 +49 -0 tests/data/test1692 +49 -0

src/tool_ipfs.c+11 -5

@@ -122,7 +122,8 @@ CURLcode ipfs_url_rewrite(CURLU uh, const char protocol, char **url,
	goto clean;
	}

-	getResult = curl_url_get(uh, CURLUPART_HOST, &cid, CURLU_URLDECODE);
+	/* keep the CID percent-encoded, it goes into the path (see note below) */
+	getResult = curl_url_get(uh, CURLUPART_HOST, &cid, 0);
	if(getResult \|\| !cid)
	goto clean;

@@ -168,11 +169,16 @@ CURLcode ipfs_url_rewrite(CURLU uh, const char protocol, char **url,
	curl_url_get(gatewayurl, CURLUPART_SCHEME, &gwscheme, CURLU_URLDECODE) \|\|
	curl_url_get(gatewayurl, CURLUPART_PORT, &gwport,
	CURLU_URLDECODE \| CURLU_DEFAULT_PORT) \|\|
-	curl_url_get(gatewayurl, CURLUPART_PATH, &gwpath, CURLU_URLDECODE))
+	curl_url_get(gatewayurl, CURLUPART_PATH, &gwpath, 0))
	goto clean;

-	/* get the path from user input */
-	if(curl_url_get(uh, CURLUPART_PATH, &inputpath, CURLU_URLDECODE))
+	/* Get the user path without decoding it, and build the new path below from
+	these still-encoded parts. Decoding here would turn an encoded slash (%2f)
+	into a real separator that the parser's earlier dot-segment cleanup never
+	saw, so a ".." could then climb out of the /<protocol>/<cid> namespace
+	when the final URL is parsed. Keeping every percent-encoded byte encoded
+	means no new separators appear and nothing new gets removed. */
+	if(curl_url_get(uh, CURLUPART_PATH, &inputpath, 0))
	goto clean;
	/* inputpath might be NULL or a valid pointer now */

@@ -191,7 +197,7 @@ CURLcode ipfs_url_rewrite(CURLU uh, const char protocol, char **url,
	protocol, cid,
	inputpath ? inputpath : "");
	if(!pathbuffer \|\|
-	curl_url_set(uh, CURLUPART_PATH, pathbuffer, CURLU_URLENCODE))
+	curl_url_set(uh, CURLUPART_PATH, pathbuffer, 0))
	goto clean;

	/* Free whatever it has now, rewriting is next */

tests/data/Makefile.am+2 -0

@@ -1709,6 +1709,8 @@ TESTCASES = \
	test1688 \
	test1689 \
	test1690 \
+	test1691 \
+	test1692 \
	\
	test1700 \
	test1702 \

tests/data/test1691+49 -0

@@ -0,0 +1,49 @@
+	<?xml version="1.0" encoding="US-ASCII"?>
+	<testcase>
+	<info>
+	<keywords>
+	IPFS
+	</keywords>
+	</info>
+
+	# Server-side
+	<reply>
+	<data nocheck="yes">
+	HTTP/1.1 200 OK
+	Date: Tue, 09 Nov 2010 14:49:00 GMT
+	Server: test-server/fake
+	Content-Length: 21
+	Connection: close
+	Content-Type: text/plain
+
+	Hello curl from IPFS
+	</data>
+	</reply>
+
+	# Client-side
+	<client>
+	<features>
+	ipfs
+	</features>
+	<server>
+	http
+	</server>
+	<name>
+	IPFS path with encoded slashes and dotdot stays under the gateway
+	</name>
+	<command>
+	--ipfs-gateway http://%HOSTIP:%HTTPPORT/private/gateway ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u/%2f..%2f..%2f..%2f..%2f..%2fadmin/config
+	</command>
+	</client>
+
+	# Verify data after the test has been "shot"
+	<verify>
+	<protocol crlf="headers">
+	GET /private/gateway/ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u/%2F..%2F..%2F..%2F..%2F..%2Fadmin/config HTTP/1.1
+	Host: %HOSTIP:%HTTPPORT
+	User-Agent: curl/%VERSION
+	Accept: /
+
+	</protocol>
+	</verify>
+	</testcase>

tests/data/test1692+49 -0

@@ -0,0 +1,49 @@
+	<?xml version="1.0" encoding="US-ASCII"?>
+	<testcase>
+	<info>
+	<keywords>
+	IPNS
+	</keywords>
+	</info>
+
+	# Server-side
+	<reply>
+	<data nocheck="yes">
+	HTTP/1.1 200 OK
+	Date: Tue, 09 Nov 2010 14:49:00 GMT
+	Server: test-server/fake
+	Content-Length: 21
+	Connection: close
+	Content-Type: text/plain
+
+	Hello curl from IPFS
+	</data>
+	</reply>
+
+	# Client-side
+	<client>
+	<features>
+	ipfs
+	</features>
+	<server>
+	http
+	</server>
+	<name>
+	IPNS path with encoded slashes and dotdot stays under the gateway
+	</name>
+	<command>
+	--ipfs-gateway http://%HOSTIP:%HTTPPORT/private/gateway ipns://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u/%2f..%2f..%2f..%2f..%2f..%2fadmin/config
+	</command>
+	</client>
+
+	# Verify data after the test has been "shot"
+	<verify>
+	<protocol crlf="headers">
+	GET /private/gateway/ipns/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u/%2F..%2F..%2F..%2F..%2F..%2Fadmin/config HTTP/1.1
+	Host: %HOSTIP:%HTTPPORT
+	User-Agent: curl/%VERSION
+	Accept: /
+
+	</protocol>
+	</verify>
+	</testcase>