-
Notifications
You must be signed in to change notification settings - Fork 27.5k
fix(ngRoute): remove extra decodeURIComponent #6327
Conversation
Thanks for the PR! Please check the items below to help us merge this faster. See the contributing docs for more information.
If you need to make changes to your pull request, you can update the commit with Thanks again for your help! |
@@ -465,9 +465,7 @@ function $RouteProvider(){ | |||
for (var i = 1, len = m.length; i < len; ++i) { | |||
var key = keys[i - 1]; | |||
|
|||
var val = 'string' == typeof m[i] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This appears to have just been a mistake in the copy/paste from Express.js's routing logic.
I'm sorry, but I wasn't able to verify your Contributor License Agreement (CLA) signature. CLA signature is required for any code contributions to AngularJS. Please sign our CLA and ensure that the CLA signature email address and the email address in this PR's commits match. If you signed the CLA as a corporation, please let us know the company's name. Thanks a bunch! PS: If you signed the CLA in the past then most likely the email addresses don't match. Please sign the CLA again or update the email address in the commit of this PR. |
Since `$location.$$path` is already decoded, doing an extra `decodeURIComponent` is both unnecessary and can cause problems. Specifically, if the path originally included an encoded `%` (aka `%25`), then ngRoute will throw "URIError: URI malformed". Closes angular#6326
CLA signature verified! Thank you! Someone from the team will now triage your PR and it will be processed based on the determined priority (doc updates and fixes with tests are prioritized over other changes). |
Can I get some feedback or an ETA? This adversely effects an application I'm developing. |
The book said: Do not decode what you don't encode. This is major issue. It breaks internationalization, it even breaks common peculiar things, imagine Computers/GNU%2FLinux/Something/Else There should be at least a way to get the pure hash, problem is that if its redirecting that hash is also lost. I've had to remove some "decodeURIComponent" from angular code, and I'm not even sure if I'm introducing security issues, because as we know, encodeURIComponent is a way to protect our applications from malicious data.. err., I'm not sure if exactly this issue, is the problem of what I'm talking about, but is very related! |
this looks valid to me. @petebacondarwin can you double-check the test (maybe add some assertion?) and get this in please? |
Will do
|
Since `$location.$$path` is already decoded, doing an extra `decodeURIComponent` is both unnecessary and can cause problems. Specifically, if the path originally includes an encoded `%` (aka `%25`), then ngRoute will throw "URIError: URI malformed". Closes angular#6326 Closes angular#6327
Since
$location.$$path
is already decoded, doing an extradecodeURIComponent
is both unnecessary and can cause problems. Specifically, if the path originally included an encoded%
(aka%25
), then ngRoute will throw "URIError: URI malformed".Closes #6326