Bug 386406

Summary: Doubly encoded URL sent to proxy
Product: [Frameworks and Libraries] frameworks-kio Reporter: Andreas Schwab <schwab>
Component: generalAssignee: David Faure <faure>
Status: RESOLVED FIXED    
Severity: normal CC: kdelibs-bugs-null
Priority: NOR    
Version First Reported In: 5.32.0   
Target Milestone: ---   
Platform: Other   
OS: Linux   
Latest Commit: https://invent.kde.org/frameworks/kio/commit/698f6d2ff4193a3c6dcde900f4287dab08087399 Version Fixed/Implemented In: 5.71.0
Sentry Crash Report:

Description Andreas Schwab 2017-10-31 22:18:45 UTC 
When using a proxy HTTPProtocol::formatRequestUri returns a doubly encoded URL.  This is because since Qt 5.2 (commit 1de1470189) the QUrl setters use DecodedMode instead of TolerantMode by default, which causes all '%' to be encoded as '%25'.  Thus a space in a URL is encoded as '%2520': QUrl::path(QUrl::FullyEncoded) encodes ' ' into '%20' and QUrl::setPath encodes it into '%2520'.
Comment 1 Ahmad Samir 2020-06-01 19:11:51 UTC 
Git commit 698f6d2ff4193a3c6dcde900f4287dab08087399 by Ahmad Samir.
Committed on 01/06/2020 at 15:20.
Pushed by dfaure into branch 'master'.

[kio_http] Parse a FullyEncoded QUrl path with TolerantMode

When using url.setPath(otherUrl.path(FullyEncoded)), we have to specify the
TolerantMode parsing mode (setPath uses DecodedMode by default), otherwise
we end up with a doubly encoded url:

otherUrl.path(FullyEncoded) would represent a space as %20 then
url.setPath(otherUrl.path(FullyEncoded), DecodedMode) would represent
the '%' character with '%25' so the path ends up with '%2520'.

AFAIU, either we use:
url.setPath(otherUrl.path(FullyDecoded), DecodedMode) OR
url.setPath(otherUrl.path(FullyEncoded), TolerantMode)

url.path() and url.setPath use FullyDecoded and DecodedMode by default,
respectively.

Thanks to Andreas Schwab for figuring it out in the bug report.
FIXED-IN: 5.71.0

M  +1    -1    src/ioslaves/http/http.cpp

https://invent.kde.org/frameworks/kio/commit/698f6d2ff4193a3c6dcde900f4287dab08087399