Some characters are incorrectly escaped in the query part of web-extension URLs

RESOLVED FIXED in Firefox 68

Status

()

defect
P2
normal
RESOLVED FIXED
3 months ago
2 months ago

People

(Reporter: andro.marian.v94, Assigned: valentin.gosu)

Tracking

(Blocks 1 bug)

66 Branch
mozilla68
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox68 fixed)

Details

(Whiteboard: [necko-triaged])

Attachments

(2 attachments)

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0

Steps to reproduce:

let page = chrome.runtime.getURL("page.html");
page += "&u="+ encodeURIComponent("
https://developer.chrome.com/extensions/tabs#type-MutedInfoReason");

chrome.tabs.update(id, { url: page });

Actual results:

Why is decode the url parameter ?

From: https%3A%2F%2Fdeveloper.chrome.com%2Fextensions%2Ftabs%23type-MutedInfoReason
Is: https%3A//developer.chrome.com/extensions/tabs%23type-MutedInfoReason

This is not happend in Google Chrome.

Summary: browser.tabs.update is decoding the encodeURLComponents → browser.tabs.update is decoding the encodeURIComponent
Summary: browser.tabs.update is decoding the encodeURIComponent → the encodeURIComponent is decoding when clicking or updative the url

Hi @Andronachi Marian, first we need some clarifications:

  1. The encodeURIComponent() function encodes a Uniform Resource Identifier (URI) component by replacing each instance of certain characters by one, two, three, or four escape sequences representing the UTF-8 encoding of the character (will only be four escape sequences for characters composed of two "surrogate" characters).
  2. You provide a URL at steps to reproduce and on at "Actual results" there are two URL encoded. Those are the results after invoking the URL ?
  3. I've tried the link provided at steps to reproduce in: https://meyerweb.com/eric/tools/dencoder/ => pressing the "Encode" button the results was (https%3A%2F%2Fdeveloper.chrome.com%2Fextensions%2Ftabs%23type-MutedInfoReason) and pressing the "Decode" button was (https://developer.chrome.com/extensions/tabs#type-MutedInfoReason).
  4. So, what is your error?
  5. Please make the things clear and let me known after. Thanks for your contribution.
Component: Untriaged → Networking: HTTP
Flags: needinfo?(andro.marian.v94)
Product: Firefox → Core

When you pass an EncodedURL to chrome.tabs.update(); or maybe when pressing a URL. The URL in the TAB_BAR will decode automatically all characters %2F to /. How the first post is From -> To.

Why the TAB_BAR URL is decoding automatically the %2F to / ?

Flags: needinfo?(andro.marian.v94)

Can you provide some clear steps to reproduce that actually work in Firefox?

chrome.runtime.getURL is not something that works when I paste it into the devtools console.
Is this for an addon?

Please be very clear and explicit with every step we need to take to reproduce the bug.

Flags: needinfo?(andro.marian.v94)

Yes is from addon.

Flags: needinfo?(andro.marian.v94)

In that case moving to the Webextensions component. I hope they have enough info to reproduce.

Component: Networking: HTTP → Untriaged
Product: Core → WebExtensions

We decode some characters for readability when we display URLs in the location bar, but underneath we still load them fully encoded.

Status: UNCONFIRMED → RESOLVED
Closed: 2 months ago
Resolution: --- → INVALID

Is not only in the location bar. If i say in DevTools "window.location.href". It's decoded.
Yes is a good idea. But its change the URL from window.location.href. In this case is not a good idea.

If i want to compare a URL and a cache URL i cant because is different from the first time.

(In reply to Andronachi Marian from comment #8)

Is not only in the location bar. If i say in DevTools "window.location.href". It's decoded.

Huh. That's interesting. I don't know what layer that's happening in, then. We pass the URL with entities intact to linkedBrowser.loadURI.

Status: RESOLVED → REOPENED
Component: Untriaged → Document Navigation
Ever confirmed: true
Product: WebExtensions → Core
Resolution: INVALID → ---

I contacted the reporter and I think I finally figured out what the problem is.

STR:
Install https://addons.mozilla.org/en-US/firefox/addon/holddingtab/
Either drag a bookmark into the URL bar, or drag one of the top sites from the about:newtab page into the URL bar.
The extension will take you to something that looks like: moz-extension://a7d1572e-3beb-4d93-a920-c408fa09e8ea/_source/holding.html?t=news.ycombinator.com&i=icons/holding.png&u=https%3A//news.ycombinator.com/
You'll notice that the u= has unescaped slashes

This can be more easily reproduced as:

var url = new URL("moz-extension://a7d1572e-3beb-4d93-a920-c408fa09e8ea/_source/holding.html?u=https%3A%2F%2Fnews.ycombinator.com%2F");
console.log(url.href); // moz-extension://a7d1572e-3beb-4d93-a920-c408fa09e8ea/_source/holding.html?u=https%3A//news.ycombinator.com/

// but you can do this:
url.search="u=https%3A%2F%2Fnews.ycombinator.com%2F";
console.log(url.href); // moz-extension://a7d1572e-3beb-4d93-a920-c408fa09e8ea/_source/holding.html?u=https%3A%2F%2Fnews.ycombinator.com%2F
Assignee: nobody → valentin.gosu
Component: Document Navigation → Networking
Priority: -- → P2
Whiteboard: [necko-triaged]
Blocks: url
Summary: the encodeURIComponent is decoding when clicking or updative the url → Some characters are incorrectly escaped in the query part of web-extension URLs

Since the SubstitutingProtocolHandler is also extended by nsResProtocolHandler, this change would also apply to resource:// URLs.

Pushed by valentin.gosu@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/948aaa76cfe9
Don't unescape %2e and %2f in the query or hash or moz-extension URLs. r=kershaw
https://hg.mozilla.org/integration/autoland/rev/18861619a4b3
Fix test_bug337744.js that expects no %2f in the query of resource URLs r=kmag,kershaw
Status: REOPENED → RESOLVED
Closed: 2 months ago2 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
You need to log in before you can comment on or make changes to this bug.