Timothy Flynn e3b5e24ce0 AK: Iterate the bytes of a URL query with an unsigned type ...

Otherwise, we percent-encode negative signed chars incorrectly. For
example, https://www.strava.com/login contains the following hidden
<input> field:

    <input name="utf8" type="hidden" value="✓" />

On submitting the form, we would percent-encode that field as:

    utf8=%-1E%-64%-6D

Which would cause us to receive an HTTP 500 response. We now properly
percent-encode that field as:

    utf8=%E2%9C%93

And can login to Strava :^)

2024-03-10 15:17:31 +01:00

20 KiB

Raw Blame History

View Raw