bugGnash - The GNU Flash player - Bugs: bug #31833, URL encode/decode with Gnash...

 
 

bug #31833: URL encode/decode with Gnash Standalone

Submitted by:  Maximiliano Castañón Araneda <maximi89>
Submitted on:  Thu 09 Dec 2010 05:43:14 PM UTC  
 
Category: coreSeverity: 3 - Normal
Release: masterStatus: Fixed
Privacy: PublicAssigned to: Sandro Santilli <strk>
Open/Closed: Closed

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Tue 02 Apr 2013 03:53:44 PM UTC, comment #8:

thanks for testing.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Tue 02 Apr 2013 03:51:52 PM UTC, comment #7:

With Current git build, getURL() on Gnash standalone worked correctly. This should be marked as fixed.

I've already submitted a duplicate report about this though. (bug #38244)

Gnash: Gnash 0.8.11dev master-21708-7d28e20 with 80989fcd, dfba5258 and 4b3dae97 reverted.
Browser: iceweasel 3.0.6-3 from Debian main repository (no addons)
System: Debian GNU/Linux 5.0 Lenny on i386

Nachanon Vetjasit <nachanon>
Wed 27 Jun 2012 03:02:27 PM UTC, comment #6:

Fixed by 6528395, please test

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 27 Jun 2012 02:15:18 PM UTC, comment #5:

Another alternative is we don't encode anything but simply pass a single argument using execv, leaving the rest to the user (producing the wrapper command)

Sandro Santilli <strk>
Project MemberIn charge of this item.
Wed 27 Jun 2012 02:06:04 PM UTC, comment #4:

The reason why we're encoding is to prevent malicious SWF from exploiting your URLOpener directive to run arbitrary shell commands.

Chances are we could get away by simply providing a quoted URL, escaping the quote character and the escape character and assume your URLOpener command understands backslash-quoting.

Sandro Santilli <strk>
Project MemberIn charge of this item.
Sun 19 Dec 2010 10:32:01 PM UTC, comment #3:

Executing "firefox http://www.youtube.com/watch%3Fv%3DJmM6OdrbSt4%26feature%3Dplayer_embedded%23at%3D194"
works perfectly, probably we need to don't encrypt the first words:

"http://www.youtube.com/..."

Maximiliano Castañón Araneda <maximi89>
Sat 11 Dec 2010 02:17:06 AM UTC, comment #2:

http://www.faqs.org/rfcs/rfc1738.html

http://www.codeguru.com/cpp/cpp/cpp_mfc/article.php/c4029

Sites who provide information about URL encode/decode and how it have to work.

Maximiliano Castañón Araneda <maximi89>
Thu 09 Dec 2010 06:14:24 PM UTC, comment #1:

http://www.http%3a%2f%2fhttp://www.agame.com.com/

Maximiliano Castañón Araneda <maximi89>
Thu 09 Dec 2010 05:43:14 PM UTC, original submission:

When we run a flash with Gnash Standalone, and we click on the links in it, it will open a link in the browser...

Terminal prints:
DEBUG: Launching URL: "/home/maximi89/Escritorio/firefox/firefox" http%3A%2F%2Fwww%2Eagame%2Ecom

Browser:
http://www.http%3a%2f%2fhttp://www.agame.com.com/

this is because it needs to encode the URL due to security problems...

a site which could help to understand:
http://www.blooberry.com/indexdot/html/topics/urlencoding.htm

Gnash Plugin use a different method.

The files related are:
URL.cpp line 406
movie_root.cpp line 2066

Maximiliano Castañón Araneda <maximi89>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by nachanon (Posted a comment)
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by maximi89 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 02 Apr 2013 03:53:44 PM UTCstrkStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Wed 27 Jun 2012 03:02:27 PM UTCstrkStatusConfirmed=>Ready For Test
      Assigned toNone=>strk
    Wed 27 Jun 2012 02:06:04 PM UTCstrkCategoryNone=>core
      StatusNone=>Confirmed

    Back to the top


    Powered by Savane 3.1-cleanup