From 734e5317c0414e391eea2a1cb95af56eea0378b7 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 31 Oct 2026 13:27:56 -0700 Subject: Drop the URL helpers' guards that cannot fire Every caller hands the helpers a string, and a value with a line break is refused by validate_value whether or not CR LF is folded on the way. --- custom/extensions/auth-file.lua | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) (limited to 'custom/extensions/auth-file.lua') diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua index 78e5020..7d4d514 100644 --- a/custom/extensions/auth-file.lua +++ b/custom/extensions/auth-file.lua @@ -218,22 +218,14 @@ end -- The URL helpers below are adapted from keplerproject/wsapi. function url_decode(str) - if not str then - return "" - end str = string.gsub(str, "+", " ") str = string.gsub(str, "%%(%x%x)", function(hex) return string.char(tonumber(hex, 16)) end) - str = string.gsub(str, "\r\n", "\n") return str end function url_encode(str) - if not str then - return "" - end - str = string.gsub(str, "\n", "\r\n") str = string.gsub(str, "([^%w ])", function(char) return string.format("%%%02X", string.byte(char)) end) @@ -245,7 +237,7 @@ end -- '=', for example a base64 password, so the value runs to the next '&'. function parse_query(query) local params = {} - for key, value in string.gmatch(query or "", "([^&=]+)=([^&]*)") do + for key, value in string.gmatch(query, "([^&=]+)=([^&]*)") do params[url_decode(key)] = url_decode(value) end return params -- cgit