Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

URL generation (in both stripes-connect and UI-Users) should encode correctly

Description

At present, you can confuse Stripes by entering a search-term like a&b – the ampersand is included literally in the generated OKAPI URL, and is taken to separate URL query parameters. Clearly search terms and other things should be URL-encoded to prevent such accidents. Some thought is needed as to which parts of the system should do this.

Environment

None

Potential Workaround

None

Checklist

hide

TestRail: Results

Activity

Show:

Mike TaylorJanuary 27, 2017 at 10:08 PM

When https://folio-org.atlassian.net/browse/STRIPES-121#icft=STRIPES-121 is done, this will be obviously the way to go.

Until then, it's impossible. You have to encode the parameters individually, otherwise the encode-everything-at-once function can't tell which ? and & are special (and so should remain unencoded) and which are literal (so should be encoded).

I'm closing this; when https://folio-org.atlassian.net/browse/STRIPES-121#icft=STRIPES-121 happens, we'll do the relevant work there.

Jason SkomorowskiJanuary 27, 2017 at 9:27 PM

The current implementation encodes just the dynamic portion coming in.

Instead, I think the encoding should take place after all substitution is complete so that module authors don't need to worry about encoding the static stuff either.

Also think it's a good idea to do this in conjunction with treating the query parameters as an object rather than part of the path string, https://folio-org.atlassian.net/browse/STRIPES-121#icft=STRIPES-121

Mike TaylorJanuary 24, 2017 at 11:44 AM

Turns out that the right function to use for this is provided as part of the JS run-time – you don't even need a library. See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURIComponent

Done

Details

Assignee

Reporter

Labels

Priority

TestRail: Cases

Open TestRail: Cases

TestRail: Runs

Open TestRail: Runs

Created January 20, 2017 at 4:34 PM
Updated February 21, 2017 at 9:46 PM
Resolved January 27, 2017 at 10:08 PM
TestRail: Cases
TestRail: Runs

Flag notifications