bugGnash - The GNU Flash player - Bugs: bug #38244, Gnash uses a double-escaped URL to...

 
 

bug #38244: Gnash uses a double-escaped URL to invoke xdg-open

Submitted by:  Nachanon Vetjasit <nachanon>
Submitted on:  Mon 04 Feb 2013 06:18:06 AM UTC  
 
Category: ActionScriptSeverity: 3 - Normal
Release: 0.8.10Status: Duplicate
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Tue 02 Apr 2013 03:49:41 PM UTC, comment #6:

After I switched to current git build, I found that
this had already reported as bug #31833 and fixed in 6528395c.

The fix seems worked, at least on GNU/Linux system.
This bug should be marked as duplicate.

Nachanon Vetjasit <nachanon>
Sat 09 Mar 2013 09:53:09 AM UTC, comment #5:

Added safety for Unix system:

Rationale: to prevent URL from escaping the single quote

According to RFC3986, an apostrophe is a valid URI character,
but most URL didn't use it, and browser sends it as %27.

After changing to this patch, my single-quote breaking test worked
(My GNOME Browser popped up at Apostrophe page on English Wikipedia)

29059:1] 404 DEBUG: get url: target=_blank, URL=http://en.wikipedia.org/wiki/', method=0 (sendVars:0, loadTarget:0, loadVariable:0)
29059:1] 405 NETWORK: getURL: HOSTFD is -1
29059:1] 405 DEBUG: Launching URL: xdg-open 'http://en.wikipedia.org/wiki/%27'

gnash: gnash-0.8.10 (Source)
system: Debian GNU/Linux 5.0 Lenny i386

Nachanon Vetjasit <nachanon>
Sat 09 Mar 2013 09:50:55 AM UTC, comment #4:

I've attached an additional test file that tries to break
the single-quoted command line using this code:

getURL("http://en.wikipedia.org/wiki/\'","_blank");

It should open the browser to Apostrophe page on English Wikipedia.
With my current dirty hack it will produce error from the shell,
and may be dangerous if it came as something like "http://en.wikipedia.org/wiki/\' ; ls \'."

(file #27584)

Nachanon Vetjasit <nachanon>
Sat 02 Mar 2013 08:41:10 AM UTC, comment #3:

This is a quick, dirty and unsafe hack:

Rationale: re-encoding breaks a valid URL

After patching, my test worked (GNOME Browser popped up)

10796:1] 298 DEBUG: get url: target=_blank, URL=http://www.getgnash.org/, method=0 (sendVars:0, loadTarget:0, loadVariable:0)
10796:1] 298 NETWORK: getURL: HOSTFD is -1
10796:1] 298 DEBUG: Launching URL: xdg-open 'http://www.getgnash.org/'

gnash: gnash-0.8.10 (Source)
system: Debian GNU/Linux 5.0 Lenny i386

Nachanon Vetjasit <nachanon>
Sat 02 Mar 2013 08:00:08 AM UTC, comment #2:

The root cause is in movie_root::getURL in libcore/movie_root.cpp

Nachanon Vetjasit <nachanon>
Tue 05 Feb 2013 06:08:22 AM UTC, comment #1:

I've attached my test flash file, compiled in MTASC 1.14
using this code:

getURL("http://www.getgnash.org/","_blank");

It worked properly on Macromedia Flash Player 7 (Win32),
and Adobe Flash Player 11 (GNU/Linux).
But broken on Gnash 0.8.10 from the reason above.

(file #27391)

Nachanon Vetjasit <nachanon>
Mon 04 Feb 2013 06:18:06 AM UTC, original submission:

I've visited incubatepictures.com homepage with Gnash 0.8.10 standalone.
The page was written entirely in Flash 8.
Aside from text issue in bug #38243, it displayed quite good.

But when I clicked the download link on "Watch the Film" section
of "There's no Tomorrow" film, the browser didn't pop up,
despite having xdg-utils installed.

This is an excerpt from output of "gnash -vv http://www.incubatepictures.com/index.swf"

It shown that gnash have re-encoded the URL before giving it to xdg-open,
rendering it corrupt.

I think the correct behaviour is to pass URL as-is from getURL to xdg-open.
But it may need some sort of command line escaping to prevent injection.

Gnash: gnash_0.8.10-1~lenny from getgnash.org APT repository
System: Debian GNU/Linux 5.0 "Lenny" i386

Nachanon Vetjasit <nachanon>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #27584:  geturlesc-test.zip added by nachanon (1kB - application/zip - single-quote breaking test on getURL xdg-open invocation)
file #27391:  geturl-test.zip added by nachanon (1kB - application/zip - Simple test on getURL function)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Updated the item)
  • -unavailable- added by nachanon (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 02 Apr 2013 03:53:01 PM UTCstrkStatusNone=>Duplicate
      Open/ClosedOpen=>Closed
    Sat 09 Mar 2013 09:50:55 AM UTCnachanonAttached File-=>Added geturlesc-test.zip, #27584
    Tue 05 Feb 2013 06:08:22 AM UTCnachanonAttached File-=>Added geturl-test.zip, #27391

    Back to the top


    Powered by Savane 3.1-cleanup