[allura] branch master updated: [#8301] fix issues with unicode and invalid urls

[ke...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

kentontaylor pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git


The following commit(s) were added to refs/heads/master by this push:
     new 95bc266  [#8301] fix issues with unicode and invalid urls
95bc266 is described below

commit 95bc2667e5ff0287b64f07e172c4934f1ea27133
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Thu Jun 6 18:34:50 2019 -0400

    [#8301] fix issues with unicode and invalid urls
---
 Allura/allura/controllers/project.py        |  1 +
 Allura/allura/controllers/rest.py           |  3 ++-
 Allura/allura/lib/custom_middleware.py      | 32 ++++++++++++++---------------
 Allura/allura/tests/functional/test_root.py |  8 ++++++++
 4 files changed, 27 insertions(+), 17 deletions(-)

diff --git a/Allura/allura/controllers/project.py b/Allura/allura/controllers/project.py
index 50461a3..58c902e 100644
--- a/Allura/allura/controllers/project.py
+++ b/Allura/allura/controllers/project.py
@@ -338,6 +338,7 @@ class ProjectController(FeedController):
     @expose()
     def _lookup(self, name, *remainder):
         name = unquote(name)
+        name = name.decode('utf-8')  # we don't support unicode names, but in case a url comes in with one
         if name == '_nav.json':
             return self, ['_nav']
 
diff --git a/Allura/allura/controllers/rest.py b/Allura/allura/controllers/rest.py
index 009b51c..291c133 100644
--- a/Allura/allura/controllers/rest.py
+++ b/Allura/allura/controllers/rest.py
@@ -306,6 +306,7 @@ def nbhd_lookup_first_path(nbhd, name, current_user, remainder, api=False):
 
     prefix = nbhd.shortname_prefix
     pname = unquote(name)
+    pname = pname.decode('utf-8')  # we don't support unicode names, but in case a url comes in with one
     provider = plugin.ProjectRegistrationProvider.get()
     try:
         provider.shortname_validator.to_python(pname, check_allowed=False, neighborhood=nbhd)
@@ -331,7 +332,7 @@ def nbhd_lookup_first_path(nbhd, name, current_user, remainder, api=False):
     if project is None:
         # look for neighborhood tools matching the URL
         project = nbhd.neighborhood_project
-        return project, (pname,) + remainder  # include pname in new remainder, it is actually the nbhd tool path
+        return project, (pname.encode('utf-8'),) + remainder  # include pname in new remainder, it is actually the nbhd tool path
     if project and prefix == 'u/':
         # make sure user-projects are associated with an enabled user
         user = project.user_project_of
diff --git a/Allura/allura/lib/custom_middleware.py b/Allura/allura/lib/custom_middleware.py
index 3cdb7a3..7b52480 100644
--- a/Allura/allura/lib/custom_middleware.py
+++ b/Allura/allura/lib/custom_middleware.py
@@ -240,22 +240,22 @@ class SSLMiddleware(object):
             request_uri.decode('ascii')
         except UnicodeError:
             resp = exc.HTTPBadRequest()
-
-        secure = req.url.startswith('https://')
-        srv_path = req.url.split('://', 1)[-1]
-        # allura-loggedin is a non-secure cookie as a flag to know that the user has a session over on https
-        force_ssl = (self._force_ssl_logged_in and req.cookies.get('allura-loggedin')) \
-                    or self._force_ssl_re.match(environ['PATH_INFO'])
-        if req.environ.get('tg.original_request'):
-            # if an error occurs, then /error/document is fetched (denoted by tg.original_request)
-            # and we don't want to do any redirects within that sub-request
-            pass
-        elif not secure and force_ssl:
-            resp = exc.HTTPFound(location='https://' + srv_path)
-        elif secure and not force_ssl:
-            resp = exc.HTTPFound(location='http://' + srv_path)
-        if not resp:
-            resp = self.app
+        else:
+            secure = req.url.startswith('https://')
+            srv_path = req.url.split('://', 1)[-1]
+            # allura-loggedin is a non-secure cookie as a flag to know that the user has a session over on https
+            force_ssl = (self._force_ssl_logged_in and req.cookies.get('allura-loggedin')) \
+                        or self._force_ssl_re.match(environ['PATH_INFO'])
+            if req.environ.get('tg.original_request'):
+                # if an error occurs, then /error/document is fetched (denoted by tg.original_request)
+                # and we don't want to do any redirects within that sub-request
+                pass
+            elif not secure and force_ssl:
+                resp = exc.HTTPFound(location='https://' + srv_path)
+            elif secure and not force_ssl:
+                resp = exc.HTTPFound(location='http://' + srv_path)
+            if not resp:
+                resp = self.app
         return resp(environ, start_response)
 
 
diff --git a/Allura/allura/tests/functional/test_root.py b/Allura/allura/tests/functional/test_root.py
index dfb11f7..d249c7c 100644
--- a/Allura/allura/tests/functional/test_root.py
+++ b/Allura/allura/tests/functional/test_root.py
@@ -89,6 +89,14 @@ class TestRootController(TestController):
             # now
             self.app.get('/', headers=dict(Accept=hdr), validate_skip=True)
 
+    def test_encoded_urls(self):
+        # not valid unicode
+        self.app.get(b'/foo\xFF', status=400)
+        self.app.get('/foo%FF', status=400)
+        # encoded
+        self.app.get('/foo%C3%A9', status=404)
+        self.app.get('/u/foo%C3%A9/profile', status=404)
+
     def test_project_browse(self):
         com_cat = M.ProjectCategory.query.find(
             dict(label='Communications')).first()