Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

url option breaks encoded URLs #181

Closed
ltm opened this issue May 13, 2020 · 3 comments · Fixed by #182
Closed

url option breaks encoded URLs #181

ltm opened this issue May 13, 2020 · 3 comments · Fixed by #182

Comments

@ltm
Copy link
Contributor

ltm commented May 13, 2020

The wrong URL will be opened when the {url: true} option is set and the URL contains encoded characters. This is particularly problematic when using reserved characters in query parameters (in practice this is common with base64-encoded values). For example:

const open = require('open');

const url = new URL('https://httpbin.org/get')
url.searchParams.append('foo', '%');
url.searchParams.append('bar', '&');
url.searchParams.append('baz', '=');

console.log(url.href);
open(url.href, {url: false});
open(url.href, {url: true});

The valid string representation of this URL is https://httpbin.org/get?foo=%25&bar=%26&baz=%3D and when opened with {url: false} the service will echo the correct parameters:

"args": {
  "bar": "&", 
  "baz": "=", 
  "foo": "%"
},

However, when opened with {url: true} the values get double-encoded:

"args": {
  "bar": "%26", 
  "baz": "%3D", 
  "foo": "%25"
},

Since query string only gets escaped correctly on WSL when {url: true} is set (cf. #171), there's currently no way to open a URL containing reserved characters in the query string on WSL.

I'm thinking that a solution would be to only encode double-quotes, i.e.:

if (options.url) {
	target = target.replace(/"/g, '%22');

	if (isWsl) {
		target = target.replace(/&/g, '^&');
	}
}

Alternatively:

const url = require('url');

// ...

if (options.url) {
	target = url.parse(target).href;

	if (isWsl) {
		target = target.replace(/&/g, '^&');
	}
}
@sindresorhus
Copy link
Owner

// @herberttn

@ltm
Copy link
Contributor Author

ltm commented May 14, 2020

@sindresorhus @herberttn The change in #182 uses url.URL to parse and encode the URL which is supported since Node v7.0.0, v6.13.0. This will work for both encoded and unencoded URLs, but it will throw a TypeError if the target is not a valid URL.

const url = require('url');

// ...

if (options.url) {
	target = new url.URL(target).href;

	if (isWsl) {
		target = target.replace(/&/g, '^&');
	}
}

@herberttn
Copy link
Contributor

I do not see any reason not to move forward with this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants