Bug 38214 - Audit use of TT url filter for uses that should be uri instead
Summary: Audit use of TT url filter for uses that should be uri instead
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Templates (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Owen Leonard
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-10-18 23:08 UTC by Phil Ringnalda
Modified: 2024-11-06 22:50 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Phil Ringnalda 2024-10-18 23:08:14 UTC
Shame the two things look so much alike in so many fonts, when you have old eyes. 

The url filter is for filtering a full URL, when you don't want to escape : or // since starting a URL with http%3A%2F%2F won't work well.

The uri filter is for filtering a URL parameter, where you want '/search?query=why%3F' rather than '/search?query=why?' which breaks your URL by having a second '?'.

Using url when you should use uri means you are leaving &, @, /, ;, :, =, +, ? and $ unescaped when you shouldn't. In many cases, the wrong use of url is on things like biblionumber, where that doesn't result in any interesting behavior, but in other cases... you can create an authorized value category named This&That=Stuff, and when you try to add a value to it, you will add a value to the category This, and pass the parameter That with the value Stuff to the script.
Comment 1 Phil Ringnalda 2024-11-06 17:00:26 UTC
And there's bug 22223 for the way that the url filter isn't really a good idea even if you do have a full URL to filter.
Comment 2 David Cook 2024-11-06 22:08:20 UTC
My favourite is how the behaviour of "uri" and "url" also changes depending on your version of Template::Toolkit. We're on 2.27 but I think there's a change in 2.28.
Comment 3 Phil Ringnalda 2024-11-06 22:38:41 UTC
Right. 2.26 and 2.27 you need to call Template::Filters->use_rfc3986() to have "(", ")", "*", "!", and "'" escaped, 2.26 you need to update to 2.27 to have '"' escaped by use_rfc3986(). 2.28 you no longer need to use_rfc3986().

So, when do we switch to 2.28?
Comment 4 David Cook 2024-11-06 22:43:16 UTC
(In reply to Phil Ringnalda from comment #3)
> Right. 2.26 and 2.27 you need to call Template::Filters->use_rfc3986() to
> have "(", ")", "*", "!", and "'" escaped, 2.26 you need to update to 2.27 to
> have '"' escaped by use_rfc3986(). 2.28 you no longer need to use_rfc3986().
> 
> So, when do we switch to 2.28?

Good question. I was just about to search up the packages in Debian and Ubuntu but both of their package search sites appear to be down.

In any case, we'll be switching accidentally I'm sure 🤣
Comment 5 David Cook 2024-11-06 22:50:25 UTC
(In reply to David Cook from comment #4)
> (In reply to Phil Ringnalda from comment #3)
> > Right. 2.26 and 2.27 you need to call Template::Filters->use_rfc3986() to
> > have "(", ")", "*", "!", and "'" escaped, 2.26 you need to update to 2.27 to
> > have '"' escaped by use_rfc3986(). 2.28 you no longer need to use_rfc3986().
> > 
> > So, when do we switch to 2.28?
> 
> Good question. I was just about to search up the packages in Debian and
> Ubuntu but both of their package search sites appear to be down.
> 
> In any case, we'll be switching accidentally I'm sure 🤣

Ok sites back up. It looks like Debian and Ubuntu are both sticking with 2.27 for the foreseeable future.

On Metacpan, it looks like 2.28 is actually from 2018, and that Template::Toolkit actually has a 3.x release dating back to late 2019 with a 3.102 having gone out in June 2024. At a glance, I don't know that 3.x is a meaningful bump as I can't see any documentation about it...

--

I'd say we probably wouldn't upgrade to 2.28 until upstream updates.