Skip to content

Commit dbdf846

Browse files
byrootbyroot
committed
Implement CGI.url_encode and CGI.url_decode
[Feature #18822] Ruby is somewhat missing an RFC 3986 compliant escape method.
1 parent 4bb04e9 commit dbdf846

3 files changed

Lines changed: 143 additions & 17 deletions

File tree

‎ext/cgi/escape/escape.c‎

Lines changed: 54 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
#include "ruby.h"
22
#include "ruby/encoding.h"
3+
#include <stdbool.h>
34

45
RUBY_EXTERN unsigned long ruby_scan_digits(const char *str, ssize_t len, int base, size_t *retlen, int *overflow);
56
RUBY_EXTERN const char ruby_hexdigits[];
@@ -200,7 +201,7 @@ url_unreserved_char(unsigned char c)
200201
}
201202

202203
static VALUE
203-
optimized_escape(VALUE str)
204+
optimized_escape(VALUE str, bool plus_escape)
204205
{
205206
long i, len, beg = 0;
206207
VALUE dest = 0;
@@ -220,7 +221,7 @@ optimized_escape(VALUE str)
220221
rb_str_cat(dest, cstr + beg, i - beg);
221222
beg = i + 1;
222223

223-
if (c == ' ') {
224+
if (plus_escape && c == ' ') {
224225
rb_str_cat_cstr(dest, "+");
225226
}
226227
else {
@@ -242,7 +243,7 @@ optimized_escape(VALUE str)
242243
}
243244

244245
static VALUE
245-
optimized_unescape(VALUE str, VALUE encoding)
246+
optimized_unescape(VALUE str, VALUE encoding, int unescape_plus)
246247
{
247248
long i, len, beg = 0;
248249
VALUE dest = 0;
@@ -265,7 +266,7 @@ optimized_unescape(VALUE str, VALUE encoding)
265266
| char_to_number(cstr[i+2]));
266267
clen = 2;
267268
}
268-
else if (c == '+') {
269+
else if (unescape_plus && c == '+') {
269270
buf[0] = ' ';
270271
}
271272
else {
@@ -348,7 +349,7 @@ cgiesc_unescape_html(VALUE self, VALUE str)
348349
* call-seq:
349350
* CGI.escape(string) -> string
350351
*
351-
* Returns URL-escaped string.
352+
* Returns URL-escaped string (+application/x-www-form-urlencoded+).
352353
*
353354
*/
354355
static VALUE
@@ -357,7 +358,7 @@ cgiesc_escape(VALUE self, VALUE str)
357358
StringValue(str);
358359

359360
if (rb_enc_str_asciicompat_p(str)) {
360-
return optimized_escape(str);
361+
return optimized_escape(str, true);
361362
}
362363
else {
363364
return rb_call_super(1, &str);
@@ -376,7 +377,7 @@ accept_charset(int argc, VALUE *argv, VALUE self)
376377
* call-seq:
377378
* CGI.unescape(string, encoding=@@accept_charset) -> string
378379
*
379-
* Returns URL-unescaped string.
380+
* Returns URL-unescaped string (+application/x-www-form-urlencoded+).
380381
*
381382
*/
382383
static VALUE
@@ -388,7 +389,50 @@ cgiesc_unescape(int argc, VALUE *argv, VALUE self)
388389

389390
if (rb_enc_str_asciicompat_p(str)) {
390391
VALUE enc = accept_charset(argc-1, argv+1, self);
391-
return optimized_unescape(str, enc);
392+
return optimized_unescape(str, enc, 1);
393+
}
394+
else {
395+
return rb_call_super(argc, argv);
396+
}
397+
}
398+
399+
/*
400+
* call-seq:
401+
* CGI.escapeURIComponent(string) -> string
402+
*
403+
* Returns URL-escaped string following RFC 3986.
404+
*
405+
*/
406+
static VALUE
407+
cgiesc_escape_uri_component(VALUE self, VALUE str)
408+
{
409+
StringValue(str);
410+
411+
if (rb_enc_str_asciicompat_p(str)) {
412+
return optimized_escape(str, false);
413+
}
414+
else {
415+
return rb_call_super(1, &str);
416+
}
417+
}
418+
419+
/*
420+
* call-seq:
421+
* CGI.unescapeURIComponent(string, encoding=@@accept_charset) -> string
422+
*
423+
* Returns URL-unescaped string following RFC 3986.
424+
*
425+
*/
426+
static VALUE
427+
cgiesc_unescape_uri_component(int argc, VALUE *argv, VALUE self)
428+
{
429+
VALUE str = (rb_check_arity(argc, 1, 2), argv[0]);
430+
431+
StringValue(str);
432+
433+
if (rb_enc_str_asciicompat_p(str)) {
434+
VALUE enc = accept_charset(argc-1, argv+1, self);
435+
return optimized_unescape(str, enc, 0);
392436
}
393437
else {
394438
return rb_call_super(argc, argv);
@@ -414,6 +458,8 @@ InitVM_escape(void)
414458
rb_mUtil = rb_define_module_under(rb_cCGI, "Util");
415459
rb_define_method(rb_mEscape, "escapeHTML", cgiesc_escape_html, 1);
416460
rb_define_method(rb_mEscape, "unescapeHTML", cgiesc_unescape_html, 1);
461+
rb_define_method(rb_mEscape, "escapeURIComponent", cgiesc_escape_uri_component, 1);
462+
rb_define_method(rb_mEscape, "unescapeURIComponent", cgiesc_unescape_uri_component, -1);
417463
rb_define_method(rb_mEscape, "escape", cgiesc_escape, 1);
418464
rb_define_method(rb_mEscape, "unescape", cgiesc_unescape, -1);
419465
rb_prepend_module(rb_mUtil, rb_mEscape);

‎lib/cgi/util.rb‎

Lines changed: 41 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,24 +5,57 @@ module Util; end
55
extend Util
66
end
77
module CGI::Util
8-
@@accept_charset="UTF-8" unless defined?(@@accept_charset)
9-
# URL-encode a string.
8+
@@accept_charset = Encoding::UTF_8 unless defined?(@@accept_charset)
9+
10+
# URL-encode a string into application/x-www-form-urlencoded.
11+
# Space characters (+" "+) are encoded with plus signs (+"+"+)
1012
# url_encoded_string = CGI.escape("'Stop!' said Fred")
1113
# # => "%27Stop%21%27+said+Fred"
1214
def escape(string)
1315
encoding = string.encoding
14-
string.b.gsub(/([^ a-zA-Z0-9_.\-~]+)/) do |m|
16+
buffer = string.b
17+
buffer.gsub!(/([^ a-zA-Z0-9_.\-~]+)/) do |m|
1518
'%' + m.unpack('H2' * m.bytesize).join('%').upcase
16-
end.tr(' ', '+').force_encoding(encoding)
19+
end
20+
buffer.tr!(' ', '+')
21+
buffer.force_encoding(encoding)
1722
end
1823

19-
# URL-decode a string with encoding(optional).
24+
# URL-decode an application/x-www-form-urlencoded string with encoding(optional).
2025
# string = CGI.unescape("%27Stop%21%27+said+Fred")
2126
# # => "'Stop!' said Fred"
22-
def unescape(string,encoding=@@accept_charset)
23-
str=string.tr('+', ' ').b.gsub(/((?:%[0-9a-fA-F]{2})+)/) do |m|
27+
def unescape(string, encoding = @@accept_charset)
28+
str = string.tr('+', ' ')
29+
str = str.b
30+
str.gsub!(/((?:%[0-9a-fA-F]{2})+)/) do |m|
31+
[m.delete('%')].pack('H*')
32+
end
33+
str.force_encoding(encoding)
34+
str.valid_encoding? ? str : str.force_encoding(string.encoding)
35+
end
36+
37+
# URL-encode a string following RFC 3986
38+
# Space characters (+" "+) are encoded with (+"%20"+)
39+
# url_encoded_string = CGI.escape("'Stop!' said Fred")
40+
# # => "%27Stop%21%27%20said%20Fred"
41+
def escapeURIComponent(string)
42+
encoding = string.encoding
43+
buffer = string.b
44+
buffer.gsub!(/([^a-zA-Z0-9_.\-~]+)/) do |m|
45+
'%' + m.unpack('H2' * m.bytesize).join('%').upcase
46+
end
47+
buffer.force_encoding(encoding)
48+
end
49+
50+
# URL-decode a string following RFC 3986 with encoding(optional).
51+
# string = CGI.unescape("%27Stop%21%27+said%20Fred")
52+
# # => "'Stop!'+said Fred"
53+
def unescapeURIComponent(string, encoding = @@accept_charset)
54+
str = string.b
55+
str.gsub!(/((?:%[0-9a-fA-F]{2})+)/) do |m|
2456
[m.delete('%')].pack('H*')
25-
end.force_encoding(encoding)
57+
end
58+
str.force_encoding(encoding)
2659
str.valid_encoding? ? str : str.force_encoding(string.encoding)
2760
end
2861

‎test/cgi/test_cgi_util.rb‎

Lines changed: 48 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ def teardown
2323
ENV.update(@environ)
2424
end
2525

26-
2726
def test_cgi_escape
2827
assert_equal('%26%3C%3E%22+%E3%82%86%E3%82%93%E3%82%86%E3%82%93', CGI.escape(@str1))
2928
assert_equal('%26%3C%3E%22+%E3%82%86%E3%82%93%E3%82%86%E3%82%93'.ascii_only?, CGI.escape(@str1).ascii_only?) if defined?(::Encoding)
@@ -70,6 +69,54 @@ def test_cgi_unescape_accept_charset
7069
end;
7170
end
7271

72+
def test_cgi_escapeURIComponent
73+
assert_equal('%26%3C%3E%22%20%E3%82%86%E3%82%93%E3%82%86%E3%82%93', CGI.escapeURIComponent(@str1))
74+
assert_equal('%26%3C%3E%22%20%E3%82%86%E3%82%93%E3%82%86%E3%82%93'.ascii_only?, CGI.escapeURIComponent(@str1).ascii_only?) if defined?(::Encoding)
75+
end
76+
77+
def test_cgi_escapeURIComponent_with_unreserved_characters
78+
assert_equal("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~",
79+
CGI.escapeURIComponent("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"),
80+
"should not encode any unreserved characters, as per RFC3986 Section 2.3")
81+
end
82+
83+
def test_cgi_escapeURIComponent_with_invalid_byte_sequence
84+
assert_equal('%C0%3C%3C', CGI.escapeURIComponent("\xC0\<\<".dup.force_encoding("UTF-8")))
85+
end
86+
87+
def test_cgi_escapeURIComponent_preserve_encoding
88+
assert_equal(Encoding::US_ASCII, CGI.escapeURIComponent("\xC0\<\<".dup.force_encoding("US-ASCII")).encoding)
89+
assert_equal(Encoding::ASCII_8BIT, CGI.escapeURIComponent("\xC0\<\<".dup.force_encoding("ASCII-8BIT")).encoding)
90+
assert_equal(Encoding::UTF_8, CGI.escapeURIComponent("\xC0\<\<".dup.force_encoding("UTF-8")).encoding)
91+
end
92+
93+
def test_cgi_unescapeURIComponent
94+
str = CGI.unescapeURIComponent('%26%3C%3E%22%20%E3%82%86%E3%82%93%E3%82%86%E3%82%93')
95+
assert_equal(@str1, str)
96+
return unless defined?(::Encoding)
97+
98+
assert_equal("foo+bar", CGI.unescapeURIComponent("foo+bar"))
99+
100+
assert_equal(@str1.encoding, str.encoding)
101+
assert_equal("\u{30E1 30E2 30EA 691C 7D22}", CGI.unescapeURIComponent("\u{30E1 30E2 30EA}%E6%A4%9C%E7%B4%A2"))
102+
end
103+
104+
def test_cgi_unescapeURIComponent_preserve_encoding
105+
assert_equal(Encoding::US_ASCII, CGI.unescapeURIComponent("%C0%3C%3C".dup.force_encoding("US-ASCII")).encoding)
106+
assert_equal(Encoding::ASCII_8BIT, CGI.unescapeURIComponent("%C0%3C%3C".dup.force_encoding("ASCII-8BIT")).encoding)
107+
assert_equal(Encoding::UTF_8, CGI.unescapeURIComponent("%C0%3C%3C".dup.force_encoding("UTF-8")).encoding)
108+
end
109+
110+
def test_cgi_unescapeURIComponent_accept_charset
111+
return unless defined?(::Encoding)
112+
113+
assert_raise(TypeError) {CGI.unescapeURIComponent('', nil)}
114+
assert_separately(%w[-rcgi/util], "#{<<-"begin;"}\n#{<<-"end;"}")
115+
begin;
116+
assert_equal("", CGI.unescapeURIComponent(''))
117+
end;
118+
end
119+
73120
def test_cgi_pretty
74121
assert_equal("<HTML>\n <BODY>\n </BODY>\n</HTML>\n",CGI.pretty("<HTML><BODY></BODY></HTML>"))
75122
assert_equal("<HTML>\n\t<BODY>\n\t</BODY>\n</HTML>\n",CGI.pretty("<HTML><BODY></BODY></HTML>","\t"))

0 commit comments

Comments
 (0)