bugGnash - The GNU Flash player - Bugs: bug #31833, URL encode/decode with Gnash...

 
 

bug #31833: URL encode/decode with Gnash Standalone

Submitted by:  Maximiliano Castañón Araneda <maximi89>
Submitted on:  Thu 09 Dec 2010 05:43:14 PM UTC  
 
Category: coreSeverity: 3 - Normal
Release: masterStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Tue 02 Apr 2013 03:53:44 PM UTC, comment #8:

thanks for testing.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 02 Apr 2013 03:51:52 PM UTC, comment #7:

With Current git build, getURL() on Gnash standalone worked correctly. This should be marked as fixed.

I've already submitted a duplicate report about this though. (bug #38244)

Gnash: Gnash 0.8.11dev master-21708-7d28e20 with 80989fcd, dfba5258 and 4b3dae97 reverted.
Browser: iceweasel 3.0.6-3 from Debian main repository (no addons)
System: Debian GNU/Linux 5.0 Lenny on i386

Nutchanon Wetchasit <nachanon>
Wed 27 Jun 2012 03:02:27 PM UTC, comment #6:

Fixed by 6528395, please test

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 27 Jun 2012 02:15:18 PM UTC, comment #5:

Another alternative is we don't encode anything but simply pass a single argument using execv, leaving the rest to the user (producing the wrapper command)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 27 Jun 2012 02:06:04 PM UTC, comment #4:

The reason why we're encoding is to prevent malicious SWF from exploiting your URLOpener directive to run arbitrary shell commands.

Chances are we could get away by simply providing a quoted URL, escaping the quote character and the escape character and assume your URLOpener command understands backslash-quoting.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Sun 19 Dec 2010 10:32:01 PM UTC, comment #3:

Executing "firefox http://www.youtube.com/watch%3Fv%3DJmM6OdrbSt4%26feature%3Dplayer_embedded%23at%3D194"
works perfectly, probably we need to don't encrypt the first words:

"http://www.youtube.com/..."

Maximiliano Castañón Araneda <maximi89>
Sat 11 Dec 2010 02:17:06 AM UTC, comment #2:

http://www.faqs.org/rfcs/rfc1738.html

http://www.codeguru.com/cpp/cpp/cpp_mfc/article.php/c4029

Sites who provide information about URL encode/decode and how it have to work.

Maximiliano Castañón Araneda <maximi89>
Thu 09 Dec 2010 06:14:24 PM UTC, comment #1:

http://www.http%3a%2f%2fwww.agame.com.com/

Maximiliano Castañón Araneda <maximi89>
Thu 09 Dec 2010 05:43:14 PM UTC, original submission:

When we run a flash with Gnash Standalone, and we click on the links in it, it will open a link in the browser...

Terminal prints:
DEBUG: Launching URL: "/home/maximi89/Escritorio/firefox/firefox" http%3A%2F%2Fwww%2Eagame%2Ecom

Browser:
http://www.http%3a%2f%2fwww.agame.com.com/

this is because it needs to encode the URL due to security problems...

a site which could help to understand:
http://www.blooberry.com/indexdot/html/topics/urlencoding.htm

Gnash Plugin use a different method.

The files related are:
URL.cpp line 406
movie_root.cpp line 2066

Maximiliano Castañón Araneda <maximi89>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by nachanon (Posted a comment)
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by maximi89 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 02 Apr 2013 03:53:44 PM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Wed 27 Jun 2012 03:02:27 PM UTCstrkStatusConfirmed=>Ready For Test
      Assigned toNone=>strk
    Wed 27 Jun 2012 02:06:04 PM UTCstrkCategoryNone=>core
      StatusNone=>Confirmed

    Back to the top


    Powered by Savane 3.1-cleanup1