bugGnash - The GNU Flash player - Bugs: bug #38244, Gnash uses a double-escaped URL to...

 
 

bug #38244: Gnash uses a double-escaped URL to invoke xdg-open

Submitter:  Nutchanon Wetchasit <nachanon>
Submitted:  Mon 04 Feb 2013 06:18:06 AM UTC
   
 
Category:  ActionScript Severity:  3 - Normal
Release:  0.8.10 Status:  Duplicate
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Tue 02 Apr 2013 03:49:41 PM UTC, comment #6: 

After I switched to current git build, I found that
this had already reported as bug #31833 and fixed in 6528395c.

The fix seems worked, at least on GNU/Linux system.
This bug should be marked as duplicate.

Nutchanon Wetchasit <nachanon>
Sat 09 Mar 2013 09:53:09 AM UTC, comment #5: 

Added safety for Unix system:


2149c2149,2150
<         std::string safeurl = url.encode(urlstr);
---
>         std::string safeurl = urlstr;
>         boost::replace_all(safeurl, "\'", "%27");


Rationale: to prevent URL from escaping the single quote

According to RFC3986, an apostrophe is a valid URI character,
but most URL didn't use it, and browser sends it as %27.

After changing to this patch, my single-quote breaking test worked
(My GNOME Browser popped up at Apostrophe page on English Wikipedia)

29059:1] 404 DEBUG: get url: target=_blank, URL=http://en.wikipedia.org/wiki/', method=0 (sendVars:0, loadTarget:0, loadVariable:0)
29059:1] 405 NETWORK: getURL: HOSTFD is -1
29059:1] 405 DEBUG: Launching URL: xdg-open 'http://en.wikipedia.org/wiki/%27'

gnash: gnash-0.8.10 (Source)
system: Debian GNU/Linux 5.0 Lenny i386

Nutchanon Wetchasit <nachanon>
Sat 09 Mar 2013 09:50:55 AM UTC, comment #4: 

I've attached an additional test file that tries to break
the single-quoted command line using this code:

getURL("http://en.wikipedia.org/wiki/\'","_blank");

It should open the browser to Apostrophe page on English Wikipedia.
With my current dirty hack it will produce error from the shell,
and may be dangerous if it came as something like "http://en.wikipedia.org/wiki/\' ; ls \'."

(file #27584)

Nutchanon Wetchasit <nachanon>
Sat 02 Mar 2013 08:41:10 AM UTC, comment #3: 

This is a quick, dirty and unsafe hack:


2149c2149
<         std::string safeurl = url.encode(urlstr);
---
>         std::string safeurl = urlstr;


Rationale: re-encoding breaks a valid URL

After patching, my test worked (GNOME Browser popped up)

10796:1] 298 DEBUG: get url: target=_blank, URL=http://www.getgnash.org/, method=0 (sendVars:0, loadTarget:0, loadVariable:0)
10796:1] 298 NETWORK: getURL: HOSTFD is -1
10796:1] 298 DEBUG: Launching URL: xdg-open 'http://www.getgnash.org/'

gnash: gnash-0.8.10 (Source)
system: Debian GNU/Linux 5.0 Lenny i386

Nutchanon Wetchasit <nachanon>
Sat 02 Mar 2013 08:00:08 AM UTC, comment #2: 

The root cause is in movie_root::getURL in libcore/movie_root.cpp


/// Try to avoid letting flash movies execute
/// arbitrary commands (sic)
///
/// Maybe we should exec here, but if we do we might have problems
/// with complex urlOpenerFormats like:
///    firefox -remote 'openurl(%u)'
///
std::string safeurl = url.encode(urlstr);
boost::replace_all(command, "%u", safeurl);

log_debug("Launching URL: %s", command);
const int ret = std::system(command.c_str());


Nutchanon Wetchasit <nachanon>
Tue 05 Feb 2013 06:08:22 AM UTC, comment #1: 

I've attached my test flash file, compiled in MTASC 1.14
using this code:

getURL("http://www.getgnash.org/","_blank");

It worked properly on Macromedia Flash Player 7 (Win32),
and Adobe Flash Player 11 (GNU/Linux).
But broken on Gnash 0.8.10 from the reason above.

(file #27391)

Nutchanon Wetchasit <nachanon>
Mon 04 Feb 2013 06:18:06 AM UTC, original submission:  

I've visited incubatepictures.com homepage with Gnash 0.8.10 standalone.
The page was written entirely in Flash 8.
Aside from text issue in bug #38243, it displayed quite good.

But when I clicked the download link on "Watch the Film" section
of "There's no Tomorrow" film, the browser didn't pop up,
despite having xdg-utils installed.


This is an excerpt from output of "gnash -vv http://www.incubatepictures.com/index.swf"

3166:1] 11202 DEBUG: get url: target=_blank, URL=http://www.filehosting.org/file/details/312163/theres_no_tomorrow_(2012)_1280x720.mp4, method=0 (sendVars:0, loadTarget:0, loadVariable:0)
3166:1] 11202 NETWORK: getURL: HOSTFD is -1
3166:1] 11203 DEBUG: Launching URL: xdg-open 'http%3A%2F%2Fwww%2Efilehosting%2Eorg%2Ffile%2Fdetails%2F312163%2Ftheres%5Fno%5Ftomorrow%5F%282012%29%5F1280x720%2Emp4'
Error showing url: The location or file could not be found.


It shown that gnash have re-encoded the URL before giving it to xdg-open,
rendering it corrupt.

I think the correct behaviour is to pass URL as-is from getURL to xdg-open.
But it may need some sort of command line escaping to prevent injection.

Gnash: gnash_0.8.10-1~lenny from getgnash.org APT repository
System: Debian GNU/Linux 5.0 "Lenny" i386

Nutchanon Wetchasit <nachanon>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #27584:  geturlesc-test.zip added by nachanon (1KiB - application/zip - single-quote breaking test on getURL xdg-open invocation)
file #27391:  geturl-test.zip added by nachanon (1KiB - application/zip - Simple test on getURL function)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by strk (Updated the item)
  • -email is unavailable- added by nachanon (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-04-02 strk StatusNone Duplicate
        Open/ClosedOpen Closed
    2013-03-09 nachanon Attached File- Added geturlesc-test.zip, #27584
    2013-02-05 nachanon Attached File- Added geturl-test.zip, #27391

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code