From ba5cbb6d828165a43826c6afdd71fa2edbdca302 Mon Sep 17 00:00:00 2001 From: Nicolai Dagestad Date: Sun, 15 Sep 2024 15:03:21 +0200 Subject: URL decode data after splitting the arguments Data decoding should happen after the parsing if not, a '?', '&', '#' or other character decoded will interfere with the parsing. e.g. the users password contains a '&', then it is truncated on that character, and login will fail. --- xs_fcgi.h | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'xs_fcgi.h') diff --git a/xs_fcgi.h b/xs_fcgi.h index 0dbd895..6d3b030 100644 --- a/xs_fcgi.h +++ b/xs_fcgi.h @@ -179,8 +179,7 @@ xs_dict *xs_fcgi_request(FILE *f, xs_str **payload, int *p_size, int *fcgi_id) req = xs_dict_append(req, "method", v); else if (strcmp(k, "REQUEST_URI") == 0) { - xs *udp = xs_url_dec(v); - xs *pnv = xs_split_n(udp, "?", 1); + xs *pnv = xs_split_n(v, "?", 1); /* store the path */ req = xs_dict_append(req, "path", xs_list_get(pnv, 0)); @@ -233,8 +232,7 @@ xs_dict *xs_fcgi_request(FILE *f, xs_str **payload, int *p_size, int *fcgi_id) const char *ct = xs_dict_get(req, "content-type"); if (*payload && ct && strcmp(ct, "application/x-www-form-urlencoded") == 0) { - xs *upl = xs_url_dec(*payload); - p_vars = xs_url_vars(upl); + p_vars = xs_url_vars(*payload); } else if (*payload && ct && xs_startswith(ct, "multipart/form-data")) { -- cgit