Cannot use / in url params

[butonic]

Steps to reproduce

1. register a route with a param, eg /resource/{id}
2. try to use an id with a /. it should be urlencoded, so the url in a request will look like /resource/id%2Fwith%2Fslashes

Expected behaviour

The controller should get id/with/slashes as a parameter.

Actual behaviour

The controller is never called because the url never matches.

1. make sure apache does not auto decode slashes by adding AllowEncodedSlashes On to the virtualhosts section. Otherwise you get an immediate 404 without php ever seeing the request
2. Even with AllowEncodedSlashes On the url gets decoded in Symphonys URLMatcher. In the worst case this might cause calling the wrong route.

Related

owncloud-archive/user_management#20 (comment)

[butonic]

It turns out symphony has a way to configure the regex used to match a parameter: https://symfony.com/doc/current/routing/slash_in_parameter.html

[butonic]

That means our resource urls are generated without this.

[ownclouders]

GitMate.io thinks possibly related issues are #883 (Can't use 'n' character in url for 'New > From Link'), #30097 (Logout URL doesn't work if using reverse proxy), #20414 (Can't use HTTPS: "URL /index.php/apps/files/ not found"), #23880 (How to use Pretty URL ?), and #16694 (No CardDav URL provided).

[phil-davis]

Are there any cases where {id} is followed by more parameters or URL parts?
e.g. there is a ``groupa`

/ocs/v1.php/settings/groups/groupa
/ocs/v1.php/settings/groups/groupa/displayName

and if you create a group called groupa/displayName then there could be trouble.
It depends how long the %2F stays around. The client is going to access:

/ocs/v1.php/settings/groupss/groupa%2FdisplayName
/ocs/v1.php/settings/users/groupa%2FdisplayName/displayName

to try and find out about that nasty-named user.

[butonic]

@paurakhsharma please try with #31224