News:

Bored?  Looking to kill some time?  Want to chat with other SMF users?  Join us in IRC chat or Discord

Main Menu

[4364] 2.0 RC3 - urls that contain [brackets] are truncated

Started by rbeuker, May 13, 2010, 08:26:49 AM

Previous topic - Next topic

rbeuker

When you try to use a link like the one below, SMF will truncate it:

http://www.trosradar.nl/index.php?id=artikel_detail&tx_ttnews[tt_news]=27928&cHash=ad35a38d5899c4d722702bda6f8bd7dc

Example:
=27928&cHash=ad35a38d5899c4d722702bda6f8bd7dc]http://www.trosradar.nl/index.php?id=artikel_detail&tx_ttnews[tt_news]=27928&cHash=ad35a38d5899c4d722702bda6f8bd7dc

We have solved it, by manually replacing the brackets:

[  becomes %5B
]  becomes %5D


So after doing the manual changes, the link looks like:

http://www.trosradar.nl/index.php?id=artikel_detail&tx_ttnews%5Btt_news%5D=27928&cHash=ad35a38d5899c4d722702bda6f8bd7dc

And now it works:

http://www.trosradar.nl/index.php?id=artikel_detail&tx_ttnews%5Btt_news%5D=27928&cHash=ad35a38d5899c4d722702bda6f8bd7dc

Could this be fixed in RC4? :)

Thanks,

Ronald

Arantor

It only truncates it if you let it try to auto convert to URLs, and this has been discussed before, in this very board in fact.

Specifically: http://www.simplemachines.org/community/index.php?topic=363099.0
See also: http://www.simplemachines.org/community/index.php?topic=377762.0

rbeuker

Quote from: Arantor on May 13, 2010, 08:30:12 AM
It only truncates it if you let it try to auto convert to URLs

I'm using the [url] and [/url] tags to create the URL.

Does that mean that I'm trying to auto convert to URLs?
If yes, how could I prevent this auto conversion?  :)

Arantor

Hmm, I assumed you were just posting the URL itself, which would attempt to auto convert.

What *exactly* are you typing?

rbeuker

Wow, you're fast!   8)

Ok, here goes:

The first line below shows what I will enter on the 2nd line:

[url]http://www.trosradar.nl/index.php?id=artikel_detail&tx_ttnews[tt_news]=27928&cHash=ad35a38d5899c4d722702bda6f8bd7dc[/url]

=27928&cHash=ad35a38d5899c4d722702bda6f8bd7dc]http://www.trosradar.nl/index.php?id=artikel_detail&tx_ttnews[tt_news]=27928&cHash=ad35a38d5899c4d722702bda6f8bd7dc
This is a mess...  :-\

And now another test, using the manual fix (note that, in the middle of the URL, I have replaced the opening bracket with %5B and I have replaced the closing bracket with %5E)

[url]http://www.trosradar.nl/index.php?id=artikel_detail&tx_ttnews%5Btt_news%5D=27928&cHash=ad35a38d5899c4d722702bda6f8bd7dc[/url]

http://www.trosradar.nl/index.php?id=artikel_detail&tx_ttnews%5Btt_news%5D=27928&cHash=ad35a38d5899c4d722702bda6f8bd7dc
And this works!!  ;D


And let's also try *without* using the url tags--in other words, using the automatic conversion by SMF:

Using the original URL:
http://www.trosradar.nl/index.php?id=artikel_detail&tx_ttnews[tt_news]=27928&cHash=ad35a38d5899c4d722702bda6f8bd7dc
Nope, not working... although it looks better than the 1st URL in this message.

Using the manually fixed URL:
http://www.trosradar.nl/index.php?id=artikel_detail&tx_ttnews%5Btt_news%5D=27928&cHash=ad35a38d5899c4d722702bda6f8bd7dc
Yes, this also works! :)


By the way, I wholeheartedly agree that websites should not use square brackets in their URLs. Still, it would be great if SMF could handle them (in particular when the url tags are used). :D

Where/how could I suggest this for a 2.0 RC4 version?

Arantor

You've already suggested it in the right place - it's a bug, I suppose.

This bug will effect every version of SMF, if I'm not mistaken, because it's a fundamental of how the bbcode parser works.

As an interim measure you can use [html] and post raw <a href> links or the fixed ones you've found.

MultiformeIngegno

RockCiclopedia (wiki - forum), Tutta la storia del rock, scritta da voi ...
Rimanere aggiornati sul mondo della musica grazie al nuovo feed "RockCiclopedia Music News"!

rbeuker


Norv

I think we should keep this in mind for the next version (after 2.0).
Thank you for the report and the explanations.
To-do lists are for deferral. The more things you write down the later they're done... until you have 100s of lists of things you don't do.

File a security report | Developers' Blog | Bug Tracker


Also known as Norv on D* | Norv N. on G+ | Norv on Github

rbeuker

No problem! :)

Is this in the Bug Tracker yet? (I have tried finding it myself, but have not found it)

Norv

It is tracked, yes, though for the time being (only for a little while longer) the project it is tracked for is not public yet. :)
Around the release of 2.0 gold, the data gathered for the next SMF version should be sorted out too, and it will be public as well.
To-do lists are for deferral. The more things you write down the later they're done... until you have 100s of lists of things you don't do.

File a security report | Developers' Blog | Bug Tracker


Also known as Norv on D* | Norv N. on G+ | Norv on Github

Norv

To-do lists are for deferral. The more things you write down the later they're done... until you have 100s of lists of things you don't do.

File a security report | Developers' Blog | Bug Tracker


Also known as Norv on D* | Norv N. on G+ | Norv on Github

Oya

except there are plenty of cases where it is used in a url even in smf itself...

Norv

It really should not be.
Can you please tell, to what uses do you refer?
To-do lists are for deferral. The more things you write down the later they're done... until you have 100s of lists of things you don't do.

File a security report | Developers' Blog | Bug Tracker


Also known as Norv on D* | Norv N. on G+ | Norv on Github

Oya

ok maybe i was slightly hasty

it IS used any time you have multiple form elements with the same name but mostly these arent sent by GET

the search system in particular uses it to identify boards to be searched - for example the contextual search for this board adds:
<input type="hidden" name="brd[37]" value="37">

your mod site definitely DOES use it though - searching for smf 20rc2 and 20rc3 gives you

http://custom.simplemachines.org/mods/index.php?action=search;downloads=;smf_versions[]=54;smf_versions[]=51;bool=or;asc;start=10

while it isnt necessarily valid html it does get used in GET for search purposes

Norv

If they're sent by POST it is not an issue IMHO - it is not in the URL. :)

Thank you for the notification about mod site... I don't seem to manage to replicate that though.
To-do lists are for deferral. The more things you write down the later they're done... until you have 100s of lists of things you don't do.

File a security report | Developers' Blog | Bug Tracker


Also known as Norv on D* | Norv N. on G+ | Norv on Github

rbeuker

Quote from: Norv on September 26, 2010, 01:18:52 PM
According to http://tools.ietf.org/html/rfc3986#section-2.2, brackets in URLs are not valid. This cannot be considered a SMF bug.

I disagree. The brackets are listed on the line that shows the 'gen-delims'

gen-delims  = ":" / "/" / "?" / "#" / "[" / "]" / "@"

These delimiters may not be used a lot, but they are valid according to this RFC. I assume SMF is not parsing them correctly, because it thinks there'll be some bbc tag?

Anyway, even if you insist that this is not a bug, there's still an easy fix:

[  becomes %5B
]  becomes %5D


How about agreeing on to disagree, and still implement this fix^H^H^Hworkaround? :P



Something like that

rbeuker is right, here. When it talks of reserved characters, they are just legal characters with special meaning. They are part of a valid URI.

rbeuker


Norv

You're right, SMF should then be aware of them and treat them appropriately.

Moved back, to be dealt with.
To-do lists are for deferral. The more things you write down the later they're done... until you have 100s of lists of things you don't do.

File a security report | Developers' Blog | Bug Tracker


Also known as Norv on D* | Norv N. on G+ | Norv on Github

Advertisement: