From 734e5317c0414e391eea2a1cb95af56eea0378b7 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 31 Oct 2026 13:27:56 -0700 Subject: Drop the URL helpers' guards that cannot fire Every caller hands the helpers a string, and a value with a line break is refused by validate_value whether or not CR LF is folded on the way. --- custom/extensions/auth-inline.lua | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) (limited to 'custom/extensions/auth-inline.lua') diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index f5ee14b..c9aa9f1 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -164,22 +164,14 @@ end -- The URL helpers below are adapted from keplerproject/wsapi. function url_decode(str) - if not str then - return "" - end str = string.gsub(str, "+", " ") str = string.gsub(str, "%%(%x%x)", function(hex) return string.char(tonumber(hex, 16)) end) - str = string.gsub(str, "\r\n", "\n") return str end function url_encode(str) - if not str then - return "" - end - str = string.gsub(str, "\n", "\r\n") str = string.gsub(str, "([^%w ])", function(char) return string.format("%%%02X", string.byte(char)) end) @@ -191,7 +183,7 @@ end -- '=', for example a base64 password, so the value runs to the next '&'. function parse_query(query) local params = {} - for key, value in string.gmatch(query or "", "([^&=]+)=([^&]*)") do + for key, value in string.gmatch(query, "([^&=]+)=([^&]*)") do params[url_decode(key)] = url_decode(value) end return params -- cgit