hoxy icon indicating copy to clipboard operation
hoxy copied to clipboard

Special characters (such as spaces) in paths are not escaped

Open jamesallardice opened this issue 9 years ago • 3 comments
trafficstars

When intercepting a request and serving a file from the local filesystem as a response, spaces in the path to that file cause problems.

This can be worked around quite easily by e.g. URI encoding the value passed to cycle.serve but it may be something that the method itself can do.

Any thoughts? I'd be happy to get a PR open for this if necessary.

jamesallardice avatar May 25 '16 12:05 jamesallardice

What sort of problems? I don't think it should URL-encode the value since it would cause already-encoded values to get double-encoded. A routine to encode just invalid characters might work, but it seems odd to me that the browser would pass along invalid chars to Hoxy in the first place.

greim avatar May 25 '16 15:05 greim

For example (very basic simplified):

const fixturePath = '/Users/somebody/some path with spaces/fixtures/fixture.json';
const proxy = hoxy.createServer({ /*... reverse proxy settings ... */ });
proxy.intercept({ phase: 'request' /* ... */ }, (req, res, cycle) => cycle.serve(fixturePath));

When that path gets through to the static file server it fails to find the file unless the spaces are URI encoded. In my case the value of fixturePath is generated (from e.g. __dirname). We ran into this problem when someone with spaces in a directory name somewhere in their structure tried to run the code in question.

jamesallardice avatar May 25 '16 15:05 jamesallardice

Ah okay. So yeah it isn't the browser generating the URL in this case. Re-reading that code, I'm remembering now issues surrounding path differences on Windows versus other platforms. Presumably the toUrlPath() method will need to sanitize its output by escaping invalid characters.

Happy to accept a PR for this!

greim avatar May 25 '16 18:05 greim